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(57) Abstract 

A location system for commercial wireless telecommunication infrastructures (CMRRs). The system is an end-to-end solution having 
one or more location systems (42) for outputting requested locations of commercially available hand sets or mobile stations (not shown) 
based on, e.g, AMPS, NAMPS, CDMA or TDMA communication standards, for processing both local mobile station location requests 
and more global mobile station location requests via, e.g., Internet communication between a distributed network of location systems. The 
system uses a plurality of mobile station locating technologies including those based on: two-way TOA and TDOA; home base stations and 
distributed antenna provisioning. Further, the system can be modularly configured for use in location signaling environments ranging from 
urban, dense urban, suburban, rural, mountain to low traffic or isolated roadways. Accordingly, the system is useful for 91 1 emergency 
calls, tracking, routing, people and animal location including applications for confinement to and from certain areas. 
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LOCATION OF A MOBILE STATION USING A PLURALITY OF COMMERCIAL 
WIRELESS INFRASTRUCTURES 



S RELATED FIELD OF THE INVENTION 

The present invention is directed generally to a system and method for locating people or objects, and in particular to a 
system and method for locating a wireless mobile radio station in a macro base station, distributed antenna, or home base station 
environment. 

BACKGROUND OF THE INVENTION 

10 Wireless communications systems are becoming increasingly important worldwide. Wireless cellular telecommunications 

systems are rapidly replacing conventional wire-based telecommunications systems in many applications. Commercial mobile radio 
service provider networks, and specialized mobile radio and mobile data radio networks are examples. The general principles of 
wireless cellular telephony have been described variously, for example in U. S. Patent 5,295,180 to Vendetti, et al, which is 
incorporated herein by reference. There is great interest in using existing infrastructures for wireless communication systems for 

15 locating people and/or objects in a cost-effective manner. Such a capability would be invaluable in a variety of situations, 

especially in emergency or crime situations. Due to the substantial benefits of such a location system, several attempts have been 
made to design and implement such a system. Systems have been proposed that rely upon signal strength and ^lateralization 
techniques to permit location include those disclosed in U.S. Patents 4,818,998 and 4,908,629 to Apsell et al. ("the Apsell 
patents") and 4,891,650 to Sheffer ("the Sheffer patent"). The Apsell patents disclose a system employing a "homing-in" scheme 

20 using radio signal strength, wherein the scheme detects radio signal strength transmitted from an unknown location. This signal 
strength is detected by nearby tracking vehicles, such as police cruisers using receivers with directional antennas. Alternatively, the 
Sheffer patent discloses a system using the FH analog cellular network. This system includes a mobile transmitter located on a 
vehicle to be located. The transmitter transmits an alarm signal upon activation to detectors located at base stations of the cellular 
network. These detectors receive the transmitted signal and transmit, to a central station, data indicating the signal strength of the 

25 received signal and the identity of the base stations receiving the signal. This data is processed to determine the distance between 
the vehicle and each of the base stations and, through ^lateralization, the vehicle's position. However, these systems have 
drawbacks that include high expense in that special purpose electronics are required. Furthermore, the systems are generally only 
effective in line-of-sight conditions, such as rural settings. Radio wave surface reflections, refractions and ground clutter cause 
significant distortion, in determining the location of a signal source in most geographical areas that are more than sparsely 

30 populated. Moreover, these drawbacks are particularly exacerbated in dense urban canyon (city) areas, where errors and/or 
conflicts in location measurements can result in substantial inaccuracies. 
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Another example of a location system using time of arrival and triangulation for location are satellite-based systems, 
such as the military and commercial versions of the Global Positioning Satellite system (GPS). GPS can provide accurate position 
determination (Le., about 100 meters error for the commercial version of GPS) from a time-based signal received simultaneously 
from at least three satellites. A ground-based GPS receiver at or near the object to be located determines the difference between 

5 the time at which each satellite transmits a time signal and the time at which the signal is received and, based on the time 

differentials, determines the object's location. However, the GPS is impractical in many applications. The signal power levels from 
the satellites are low and the GPS receiver requires a clear, line-of-sight path to at least three satellites above a horizon of about 60 
degrees for effective operation. Accordingly, inclement weather conditions, such as clouds, terrain features, such as hills and trees, 
and buildings restrict the ability of the GPS receiver to determine its position. Furthermore, the initial GPS signal detection process 

10 for a GPS receiver is relatively long (Le., several minutes) for determining the receiver's position. Such delays are unacceptable in 
many applications such as, for example, emergency response and vehicle tracking. 

Differential GPS, or DGPS systems offer correction schemes to account for time synchronization drift. Such correction 
schemes include the transmission of correction signals over a two-way radio linker broadcast via FM radio station subcarriers. 
These systems have been found to be awkward and have met with limited success. 

15 Additionally, GPS-based location systems have been attempted in which the received GPS signals are transmitted to a 

central data center for performing location calculations. Such systems have also met with limited success due, for example, to the 
limited reception of the satellite signals and the added expense and complexity of the electronics required for an inexpensive 
location mobile station or handset for detecting and receiving the GPS signals from the satellites. 

The behavior of a mobile radio signal in the general environment is unique and complicated. Efforts to perform 

20 correlation between radio signals and distance between a base station and a mobile station are similarly complex. Repeated 

attempts to solve this problem in the past have been met with only marginal success. Factors include terrain undulations, fixed and 
variable clutter, atmospheric conditions, internal radio characteristics of cellular and PCS systems, such as frequencies, antenna 
configurations, modulation schemes, diversity methods, and the physical geometry of direct, refracted and reflected waves between 
the base stations and the mobile. Noise, such as man-made externally sources (e.g. t auto ignitions) and radio system co-channel 

25 and adjacent channel interference also affect radio reception and related performance measurements, such as the analog carrier-to- 
interference ratio (C/l), or digital energy-per-bit/Noise density ratio (E b/No ) and are particular to various points in time and space 
domains. 

Before discussing real world correlation between signals and distance, it is useful to review the theoretical premise, that 
of radio energy path loss across a pure isotropic vacuum propagation channel, and its dependencies within and among various 
30 communications channel types. 

Over the last forty years various mathematical expressions have been developed to assist the radio mobile cell designer in 
establishing the proper balance between base station capital investment and the quality of the radio link, typically using radio 
energy field-strength, usually measured in microvolts/meter, or decibels. 
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One consequence from a location perspective is that the effective range of values for higher exponents is an increased at 
higher frequencies, thus providing improved granularity of ranging correlation. 

Actual data collected in real-world environments uncovered huge variations with respect to the free space path loss 
equation, giving rise to the creation of many empirical formulas for radio signal coverage prediction. Clutter, either fixed or 
5 stationary in geometric relation to the propagation of the radio signals, causes a shadow effect of blocking that perturbs the free 
space loss effect. Perhaps the best known model set that characterizes the average path loss is Hata's, "Empirical Formula for 
Propagation Loss in Land Mobile Radio", M. Hata, IEEE Transactions^-?}, pp. 317-325, August 1980, three pathloss models, based 
on Okumura's measurements in and around Tokyo, "Field Strength and its Variability in VHF and UHF Land Mobile Service", Y. 
Okumura, et al, Review of the Electrical Communications laboratory, Vol 16, pp 825-873, Sept. - Oct. 1968. 
10 Although the Hata model was found to be useful for generalized RF wave prediction in frequencies under I GHz in 

certain suburban and rural settings, as either the frequency and/or clutter increased, predictability decreased. In current practice, 
however, field technicians often have to make a guess for dense urban an suburban areas (applying whatever model seems best), 
then installing a base stations and begin taking manual measurements. 

In 1991, U.S. Patent 5,055,851 to Sheffertaught that if three or more relationships have been established in a triangular 
15 space of three or more base stations (BSs) with a location database constructed having data related to possible mobile station (MS) 
locations, then arculation calculations may be performed, which use three distinct P or measurements to determine an X t Y, two 
dimensional location, which can then be projected onto an area map. The triangulation calculation is based on the fact that the 
approximate distance of the mobile station (MS) from any base station (BS) cell can be calculated based on the received signal 
strength. Sheffer acknowledges that terrain variations affect accuracy, although as noted above, Sheffer's disclosure does not 
20 account for a sufficient number of variables, such as fixed and variable location shadow fading, which are typical in dense urban 
areas with moving traffic. 

Most field research before about 1988 has focused on characterizing (with the objective of RF coverage prediction) the RF 
propagation channel (Le. t electromagnetic radio waves) using a single-ray model, although standard fit errors in regression: 
proved dismal (e.g. t 40-80 dB). Later, multi-ray models were proposed, and much later, certain behaviors were studied with radio 

25 and digital channels. In 1981, Vogler proposed that radio waves at higher frequencies could be modeled using optics principles. In 
1988 Walfisch and Bertoni applied optical methods to develop a two-ray model, which when compared to certain highly specific, 
controlled field data, provided extremely good regression fit standard errors of within 1 2 dB. 

In the Bertoni two ray model it was assumed that most cities would consist of a core of high-rise buildings surrounded 
by a much larger area having buildings of uniform height spread over regions comprising many square blocks, with street grids 

30 organizing buildings into rows that are nearly parallel. Rays penetrating buildings then emanating outside a building were 
neglected. 

After a lengthy analysis it was concluded that path loss was a function of three factors: I .) the path loss between 
antennas in free space; 1) the reduction of rooftop wave fields due to settling; and 3.) the effect of diffraction of the rooftop fields 
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down to ground level. 

However, a substantial difficulty with the two-ray model in practice is that it requires a substantial amount of data 
regarding building dimensions, geometry, street widths, antenna gain characteristics for every possible ray path, etc. Additionally, 
it requires an inordinate amount of computational resources and such a model is not easily updated or maintained. 
5 Unfortunately, in practice clutter geometry and building heights are random. Moreover, data of sufficient detail is 

extremely difficult to acquire, and regression standard fit errors are poor, i.e., in the general case, these errors were found to be 40- 
60 dB. Thus the two-ray model approach, although sometimes providing an improvement over single ray techniques, still did not 
predict RF signal characteristics in the general case to level of accuracy desired (< lOdB). 

Work by Greenstein has since developed from the perspective of measurement-based regression models, as opposed to the 

1 0 previous approach of predicting-first, then performing measurement comparisons. Apparently yielding to the fact that low-power, 
low antenna {e.g., 12-25 feet above ground) height PCS microcell coverage was insufficient in urban buildings, Greenstein, et al, 
authored "Performance Evaluations for Urban Line-of-sight Microcells Using a Multi-ray Propagation Model", in IEEE Globecom 
Proceedings, 12/91. This paper proposed the idea of formulating regressions based on field measurements using small PCS 
microcells in a lineal microcell geometry (i.e., geometries in which there is always a line-of-sight path between a subscriber's mobile 

15 and its current microsite). Additionally, Greenstein studied the communication channels variable Bit-Error-Rate (BER) in a spatial 
domain, which was a departure from previous research that limited field measurements to the RF propagation channel signal 
strength alone. However, Greenstein based his finding on two suspicious assumptions: I) he assumed that distance correlation 
estimates were identical for uplink and downlink transmission paths; and 2) modulation techniques would be transparent in terms 
of improved distance correlation conclusions. Although some data held very correlation, other data and environments produced 

20 poor results. Accordingly, his results appear unreliable for use in general location context. 

In 1993 Greenstein, et al, authored M A Measurement-Based Model for Predicting Coverage Areas of Urban Microcells", in 
the IEEE Journal On Selected Areas in Communications, Vol. 1 1, No. 7, 9/93. Greenstein reported a generic measurement-based 
model of RF attenuation in terms of constant-value contours surrounding a given low-power, low antenna microcell environment in 
a dense, rectilinear neighborhood, such as New York City. However, these contours were for the cellular frequency band. In this 

25 case, LOS and non-LOS clutter were considered for a given microcell site. A result of this analysis was that RF propagation losses 
(or attenuation), when cell antenna heights were relatively low, provided attenuation contours resembling a spline plane curve 
depicted as an asteroid, aligned with major street grid patterns. Further, Greenstein found that convex diamond-shaped RF 
propagation loss contours were a common occurrence in field measurements in a rectilinear urban area. The special plane curve 
asteroid is represented by the formula: 

30 x w + y w = r 2 ^. However, these results alone have not been sufficiently robust and general to accurately iocate an 

mobile station, due to the variable nature of urban clutter spatial arrangements. 

At Telesis Technology in 1994 Howard Xia, et al, authored "Microcellular Propagation Characteristics for Personal 
Communications in Urban and Suburban Environments", in IEEE Transactions of Vehicular Technology, Vol. 43, No. 3, 8/94, which 
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performed measurements specifically in the PCS 1.8 to 1.9 GHz frequency band. Xia found corresponding but more variable 
outcome results in San Francisco, Oakland (urban) and the Sunset and Mission Districts (suburban). 

The physical radio propagation channel perturbs signal strength, frequency (causing rate changes, phase delay, signal to 
noise ratios (e.g^ C/l for the analog case, or E b/No , RF energy per bit, over average noise density ratio for the digital case) and 
Doppler-shift. Signal strength is usually characterized by: 

• Free Space Path Loss (L p ) 

• Slow fading loss or margin (L,^) 

• Fast fading loss or margin 



The cell designer increases the transmitted power ? n by the shadow fading margin L,, w which is usually chosen to be 
within the 1-2 percentile of the slow fading probability density function (PDF) to minimize the probability of unsatisfactorily low 
received power level at the receiver. The P^ level must have enough signal to noise energy level (e.g., 10 dB) to overcome the 
receiver's internal noise level (e.g., -I l8dBm in the case of cellular 0.9 GHz), for a minimum voice quality standard. Thus in this 
example must never be below -108 dBm, in order to maintain the quality standard. 

Additionally the short term fast signal fading due to multipath propagation is taken into account by deploying fast 
fading margin L^, which is typically also chosen to be a few percentiles of the fast fading distribution. The I to 2 percentiles 
compliment other network blockage guidelines. For example the cell base station traffic loading capacity and network transport 
facilities are usually designed for a 1-2 percentile blockage (actor as well. However, in the worst-case scenario both fading margins 
are simultaneously exceeded, thus causing a fading margin overload. 

In Roy Steele's, text, Mobile Radio Communications, IEEE Press, 1992, estimates for a GSM system operating in the 1 .8 
GHz band with a transmitter antenna height of 6.4m and a mobile station receiver antenna height of 2m, and assumptions 
regarding total path loss, transmitter power would be calculated as follows: 



Table I: GSM Power Budget Example 



Parameter 


dBm value 


Will require 


'■slow 


14 




L fast 


7 




L, path 


no 




Min. RX pwr required 


•104 








TXpwr = 27 dBm 



5 
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Steele's sample siie in a specific urban London area of 80,000 LOS measurements and data reduction found a slow 
fading variance of 

5 a = 7dB 

assuming log-normal slow fading PDF and allowing for a 1.4% slow fading margin overload, thus 
slow = 2a = 14dB 

10 

The fast fading margin was determined to be: 
Lfas, - 7dB 

15 In contrast, Xia's measurements in urban and suburban California at 1.8 GHz uncovered flat-land shadow fades on the 

order of 25-30 dB when the mobile station (MS) receiver was traveling from LOS to non-LOS geometries. In hilly terrain fades of 
+5 to -50 dB were experienced. Thus it is evident that attempts to correlate signal strength with mobile station ranging distance 
suggest that error ranges could not be expected to improve below 14 dB, with a high side of 25 to 50 dB. Based on 20 to 40 dB per 
decade, Corresponding error ranges for the distance variable would then be on the order of 900 feet to several thousand feet, 

20 depending upon the particular environmental topology and the transmitter and receiver geometries. 

Although the acceptance of fuzzy logic has been generally more rapid in non-American countries, the principles of fuzzy 
logic can be applied in wireless location. Lotfi A. Zadeh's article, "Fuzzy Sets" published in 1965 in Information and Control, vol. 8, 
Pg 338-353, herein incorporated by reference, established the basic principles of fuzzy logic, among which a key thorem, the FAT 
theorem, suggests that a fuzzy system with a finite set of rules can uniformly approximate any continuous (or Borel-measureable) 
25 system. The system has a graph or curve in the space of all combinations of system inputs and outputs. Each fuzzy rule defines a 
patch in this space. The more uncertain the rule, the wider the patch. A finite number of small patches can always cover the curve. 
The fuzzy system averages patches that overlap. The Fat theorem was proven by Bart Kosko, in a paper entitled, "Fuzzy Systems as 
Universal Approximators", in Proceedings of the First IEEE Conference on Fuzzy Systems, Pages 1153-11 62, in San Diego, on March, 
1992, herein incorporated by reference. 

30 Fuzzy relations map elements of one universe, say "X", to those of another universe, say "Y", through the Cartesian 

product of the two universes. However, the "strength" of the relation between ordered pairs of the two universes is not measured 
with the characteristic function (in which an element is either definitely reltated to another elemetn as indicated by a strength 
value of T, or is definitely not related to another element as indicated by a strength value of "0", but rather with a membership 
function expressing various "degrees" of strength of the relation on the unit intergval [0,1]. Hence, a fuzzy relation R is a 
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mapping from the Cartesian space X x Y to the interval [0,1], where the strength of the mapping is expressed by the membership 
function of the relation for ordered pairs from the two universes or ^ R (x,y). 

Just as for crisp relations, the properties of commutativity, associativity, distributivity, involution and idempotency all 
hold for fuzzy relations. Moreover, DeMorgan's laws hold for fuzzy relations just as they do for crisp (classical) relations, and the 
null relations 0, and the complete relation, E, are analogous to the null set and the whole set in set-theretic from, respectively. The 
properties that do not hold for fuzzy relations, as is the case for fuzzy sets in general, are the excluded middle laws. Since a fuzzy 
relation R is also a fuzzy set, there is overlap between a relation and its complement, hence. 



As seen in the foregoing expression, the excluded middle laws for relation do not result in the null relation, 0, or the 
complete relation, E. Because fuzzy relations in general are fuzzy sets, the Cartesian product can be defined as a relations between 
two or more fuzzy sets. Let A be a fuzzy set on universe X and B be a fuzzy set on universe Y; then the Cartesian product between 
fuzzy sets A and B will result in a fuzzy relation R, which is contained within the full Cartesian product space, or 

AxB = Rc XxY 

where the fuzzy relation R has membership function: 
Hufcy) = HaxbM = rain Oi*(x).MbM) 

Fuzzy composition an be defined just as it is for crisp (binary) relations. If R is a fuzzy relation on the Cartesian space 
X x Y, and S is a fuzzy relation on the Cartesian space Y x Z, and T is a fuzzy relation on the Cartesian space X x Z; then fuzzy 
max-min composition is defined in terms of the set-theoretic notation and membership function-theoretic notation in the following 
manner 

Hi<*.y) = v (Mw) A Msfar)) = max { min [M*.y)> Mste) ] > 

The fuzzy extension principle allows for transforms or mappings of fuzzy concepts in the form y = f(x). This principle, 
combined with a compositional rule of inference, allows for a crisp input to be mapped through a fuzzy transform using . 
membership functions into a crisp output. Additionally , in mapping a cariable x into a variale y, both x and y can be vector 
quantities. 
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SUMMARY OF THE INVENTION 

OBJECTS OF THE INVENTION 

It is an objective of the present invention to provide a system and method for determining wireless location using one or 
5 more commercial mobile radio telecommunication systems (or accurately locating people and/or objects in a cost effective manner. 
Related objectives for the present invention include providing a system and method that: 

(1) can be readily incorporated into existing commercial wireless telephony systems with few, if any, modifications of a 
typical telephony wireless infrastructure; 

(2) can use the native electronics of typical commercially available telephony wireless mobile stations (e.g., handsets) as 
10 location devices; 

(3) can be used for locating people and/or objects residing indoors. 

Yet another objective is to provide a low cost location system and method, adaptable to wireless telephony systems, for 
using simultaneously a plurality of base stations owned and/or operated by competing commercial mobile radio service providers 
within a common radio coverage area, in order to achieve FCC phase 2 accuracy requirements, and for synergistically increasing 
1 5 mobile station location accuracy and consistency. 

Yet another objective is to provide a low cost location system and method, adaptable to wireless telephony systems, for 
using a plurality of location techniques In particular, at least some of the following mobile station location techniques can be 
utilized by various embodiments of the present invention: 

•time-of-arrival wireless signal processing techniques; 
20 •time-difference-of-arrival wireless signal processing techniques; 

•wireless signal processing techniques. 

Yet another objective is to provide a system and method for flexible delivery of location information to Public Safety 
Answering Points, end users, centralized dispatchers, as well as to agents (either human or mechanized) associated with trigger- 
based inventory and tracking systems. Flexible delivery used here indicates providing location via various two dimensional closed- 
25 form shapes, such as polygons, ellipses, etc., which bound the location probabilities. In cases where height location information is 
known, the bounding shape may be three-dimensional. 

Yet another objective is to provide a system and method for a variety of new location-based services for public and 
private group safety, including family support functions. 

Yet another objective is to provide a system and method for National Scale Wireless Location capability. Although the 
30 primary focus of this patent is to provide wireless location with accuracy to meet the FCC phase two requirements, a system and 
method is provided that also utilizes roaming signaling to determine in which city is a particular wireless mobile station located. 
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Yet another objective is to provide and system and method for Parametric-driven, intelligent agent-based location 
services. Parameters may include time, location, and user-specific and/or group specific criteria. 

Yet another objective is to provide a system and method for determining and/or enhancing wireless location using one 
or more of the following: (a.) CDMA-based Distributed Antenna technology; (b.) Home Base Stations and AIN technology. 
5 Yet another objective is to provide notification messages and/or voice-synthesized call or text paging funaion to a 

plurality of other mobile station users when a mobile station user travel into, or away from, one or more zones or are within short 
distances of shopping malls, stores, merchandising dealers etc. 

Yet another objective is to provide notification messages and/or voice-synthesized call or text paging functions to a 
plurality of other mobile station users when a mobile station dials a redefined telephone number, such as 91 1, or a type of "mild 
10 emergency cry for help* number. 

Yet another objective is to provide notification messages and/or voice-synthesized call or text paging funaion to a 
plurality of other mobile station users when a mobile station user dials a predefined telephone number, such as 3 1 1 , or a type of 
mild emergency cry for help number, wherein the plurality of other mobile station users are within a particular distance, or a 
minimum distance to the mobile station user who dialed the predefined number. 
IS Yet another objective is to provide notification messages and/or voice-synthesized call or text paging funaion to a 

plurality of other mobile station users when a mobile station user dials a predefined telephone number, such as 31 1, or a type of 
mild emergency cry for help number, wherein the plurality of other mobile station users are within a particular distance, or a 
minimum distance to the mobile station user who dialed the predefined number, and wherein the other mobile station users are 
provided individualized direttional or navigation information from their current locations, to reach to the mobile station user who 
20 dialed the predefined number. 

Yet another objeaive is to provide automatic home office, vehicle and boat security funaions, which are activated and 
deaaivated based on a mobile station user's location to or away from a location associated with the security funaions. 

Yet another objeaive is to provide notifications (e.g., via fax, page, e-mail, text paging or voice synthesized call 
message), or to setup a group conference call capability to a plurality of predefined individuals, based on a mobile station user's 
25 call to 91 1, or based on a mobile station user's traveling into or away from a location zone or area, or based upon a sensor input 
signal to the user's mobile station, such as a sudden change in G forces, such as falling down, having the car hit another object 
suddenly, air bag deployment, etc. 

Yet another objeaive is to provide location information to a 'searcher' mobile station user who then further refines or 
narrows the scope of the location/search for a 'target' mobile station, or the mobile station to be located, using a small microwave 
30 dish, in communication with, or to supplement/replace the searcher mobile station antenna, whose physical orientation is used to 
further determine the target mobile station location, relative to the searcher's mobile station position/orientation. 

Yet another objeaive is to provide a means to allow more flexible storage, inventory and enhanced user accessibility of 
rental vehicles, by combining location technology of rental car driver carrying his/her own mobile station, along with a mobile 

9 
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station which remains always active and fixed to a rental car. By maintaining accurate location records of rental car locations and 
automatic, remote-control of rental cars (or smart cars) which use the mobile station to telemeter control data to and from the car, 
whose doors, doorlocks, and general accessibility are controlled by a centralized computer system, rental cars can be dropped off at 
convenient shopping center malls, airport parking lots, hotels and at other convenient locations. 
5 Yet another objective is to provide location estimates to users carrying mobile stations, via voice synthesis, data circuit 

messaging or text paging. 

Yet another objective is to provide a mechanism whereby mobile station users may access and control their subscriber 
profile for location purposes. The location subscriber profile is a persistent data store which contains logic regarding under what 
criteria will that mobile station user allow his/her location to be made known, and to whom. The mobile station user may access the 
10 location profile via several methods, including Internet means, and mobile station handset keypad entry and voice recognition 
circuits. 

Yet another objective is to utilize signaling detection characteristics of other CDMA base stations and systems in a given 
area, owned and operated by a plurality another commercial mobile radio service provider (CMRS provider). By including other 
CMRS providers' infrastructure in the location estimation analysis process, improvements in location accuracy can be realized. 

IS 

DEFINITIONS 

The following definitions are provided for convenience. In general, the definitions here are also defined elsewhere in 
this document as well. 

(1) The term wireless herein is, in general, an abbreviation for digital wireless, and in particular, wireless refers to digital 
20 radio signaling using one of standard digital protocols such as CDMA, TDMA and GSM, as one skilled in the art will understand. 

(2) As used herein, the term mobile station (equivalently, MS) refers to a wireless device that is at least a transmitting 
device, and in most cases is also a wireless receiving device, such as a portable radio telephony handset. Note that in some contexts 
herein instead or in addition to mobile station, the following terms are also used: personal station (PS), and location unit (LU). In 
general, these terms may be considered synonymous. However, the later two terms may be used when referring to reduced 

25 functionality communication devices in comparison to a typical digital wireless mobile telephone. 

(3) The term, inf rastructure, denotes the network of telephony communication services, and more particularly, that portion 
of such a network that receives and processes wireless communications with wireless mobile stations. In particular, this 
infrastructure includes telephony wireless base stations (BS) such as those for radio mobile communication systems based on CDMA, 
TDMA, and GSM wherein the base stations provide a network of cooperative communication channels with an air interface with the 

30 mobile station, and a conventional telecommunications interface with a Mobile Switch Center (MSC). Thus, an MS user within an 
area serviced by the base stations may be provided with wireless communication throughout the area by user transparent 
communication transfers (i.e. t hand-offs) between the user's mobile station and these base stations in order to maintain effective 

10 
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telephony service. The mobile switch center provides communications and control connectivity among base stations and the public 
telephone network. 

(4) An example of a Parametric-driven intelligent agent-based location service follows: An intelligent agent software process 
monitors sets of Parametric conditions and location scenarios. When appropriate conditions and location criteria are satisfied, then 

5 a set of notifications or other actions are triggered to occur. A specific example follows: given that a certain child carrying a mobile 
station should be in a certain school between 8:00 A.M. and 3:00 P.M. on regular school days, then a wireless location request is 
invoked periodically, within the school day time frame. If a location request determines that the child's mobile station is located 
substantially outside of the general school area, then a parent/guardian is notified of that fact, and of the child's location via any 
of several methods, such as: (a.) a voice-synthesized telephone message, (b.) various extranet/internet means, such as electronic 

10 mail, netcasting, such as the product Castanet, by Marimba Software, Inc., (c.) fax to a predetermined telephone number, or (d.) 
alpha-numeric text paging. 

(5) Commercial mobile radio service (CMRS) service provider is the referenced name of the company that owns and/or 
operates a publicly accessible wireless system in the cellular or PCS spectrum radio bands. 



(I .) receiving signal data measurements corresponding to wireless communications between an mobile station to 
be located (herein also denoted the target mobile station) and a wireless telephony infrastructure, wherein the mobile station, BS 
and/or mobile switch center may be enhanced in certain novel and cost effective ways so as to provide an extended number of 
values characterizing the wireless signal communications between the target mobile station and the base station infrastructure, 

20 such infrastructure including multiple, distinct CMRS where base stations share a common coverage area; 

(2.) organizing and processing the signal data measurements received from a given target mobile station and 
surrounding base stations so that composite wireless signal characteristic values may be obtained from which target mobile station 
location estimates may be derived. In particular, the signal data measurements are ensembles of samples from the wireless signals 
received from the target mobile station by the base station infrastructure, and from associated base stations wherein these samples 

25 are subsequently filtered using analog and digital spectral filtering. (3.) providing the resultant location estimation characteristic 
values to a mobile station location estimate module, wherein each such model subsequently determines the estimate of the location 
of the target mobile station based on, for example, the signal processing techniques I . through 2. above. 

Accordingly, steps (I.) and (2.) above are performed by a subsystem of the invention denoted the Signal Processing and 
Filtering Subsystem (or simply the Signal Processing Subsystem). In particular, this subsystem receives samples of wireless signal 

30 characteristic measurements such as a plurality of relative signal strengths and corresponding signal time delay value pairs, 

wherein such samples are used by this subsystem to produce the component with the least amount of multipath, as evidenced in the 
sample by the short time delay value, wherein each such value pair is associated with wireless signal transmissions between the 



SUMMARY DISCUSSION 



IS 



The location system of the present invention accomplishes the above and other objectives by the following steps: 
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target mobile station and a particular base station of a predetermined wireless base station infrastructure. Extremely transient 
signal anomalies such as signal reflection from tree leaves or the passing of a truck are likely to be filtered out by the Signal 
Processing Subsystem. For example, such an ensemble of data value pairs can be subjected to input cropping and various median 
filters employing filtering techniques such as convolution, median digital, Fast Fourier transform, Radon transform, Gabar 
transform, nearest neighbor, histogram equalization, input and output cropping, Sobel, Wiener, and the like. 

It is a further aspect of the present invention that the wireless personal communication system (PCS) inf restructures 
currently being developed by telecommunication providers offer an appropriate localized infrastructure base upon which to build 
various personal location systems employing the present invention and/or utilizing the techniques disclosed herein. In particular, 
the present invention is especially suitable for the location of people and/or objects using code division multiple access (CDMA) 
wireless infrastructures, although other wireless infrastructures, such as, time division multiple access (TDMA) infrastructures and 
GSM are also contemplated. Note that CDMA personal communications systems are described in the Telephone industries 
Association standard IS-95, for frequencies below I GHz, and in the Wideband Spread - Spectrum Digital Cellular System Dual-Mode 
Mobile Station-Base Station Compatibility Standard, for frequencies in the 1.8-1.9 GHz frequency bands, both of which are 
incorporated herein by reference. Furthermore, CDMA general principles have also been described, for example, in U. S. Patent 
5,109390, to Gilhausen, et al, and CDMA Network Engineering Handbook by Qualcomm, Inc., each of which is also incorporated 
herein by reference. 

In another aspect of the present invention, in environments where a home base station capability exists, then wireless 
location can be provided under certain circumstances, wherein when a mobile station user is within a predetermined range of, for 
example, 1000 feet of his/her premises, the user's mobile station is detected through mobile station receiving electronics provided 
in, for example, cordless telephone units as being at home. Thus, the local public telephone switching network may be provided with 
such information for registering that user is at home, and therefore the mobile station may be allowed to function as a cordless 
home telephone utilizing the local public telephone switching network instead of the base station infrastructure. According to this 
aspect of the present invention, the location center of the present invention receives notification from the local public switched 
telephone network that the mobile station is at or near home and utilizes this notification in outputting a location estimate for the 
mobile station. 

In yet another aspect, the present invention includes a capability for locating a target mobile station within areas of 
poor reception for infrastructure base stations by utilizing distributed antennas. A distributed antenna system as used herein is a 
collection of antennas attached in series to a reduced function base station, wherein the antennas are distributed throughout an 
area for improving telephony coverage. Such distributed antenna systems are typically used in indoor environments (e.g., high rise 
buildings) or other areas wherein the signal to noise ratio is too high for adequate communication with standard infrastructure 
base stations. Also a distributed antenna system may be located such that its coverage pattern overlaps the area of coverage of 
another distributed antenna system. In such cases each of the overlapping distributed antenna systems includes purposeful delay 
elements to provide different signal delays for each of the overlapping antenna systems and thereby provide multipath signals with 
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sufficient delay spread for signal discrimination, as one skilled in the art will understand. Accordingly, the present invention 
receives and utilizes location information communicated from distributed antenna systems for locating a target mobile station. 
That is, the present invention may receive information from the base station infrastructure indicating that a target mobile station is 
communicating with such a distributed antenna system and provide distributed antenna signal characteristic values related to the 
distributed antenna system. Accordingly, to process such target mobile station location signal data, the present invention includes a 
distributed antenna system for generating target mobile station location estimate derived from the location signal data obtained 
from the distributed antenna system. 

The location system of the present invention offers many advantages over existing location systems. The system of the 
present invention, for example, is readily adaptable to existing wireless communication systems and can accurately locate people 
and/or objects in a cost-effective manner. In particular, the present invention requires few, if any, modifications to commercial 
wireless communication systems for implementation. Thus, existing personal communication system infrastructure base stations 
and other components of, for example, commercial CDMA infrastructures are readily adapted to the present invention. The present 
invention can be used to locate people and/or objects that are not in the line-of-sight of a wireless receiver or transmitter, can 
reduce the detrimental effects of multipath on the accuracy of the location estimate, can locate people and/or objects located 
indoors as well as outdoors, and uses a number of wireless stationary transceivers for location. The present invention employs a 
number of distinctly different location computational models for location which provides a greater degree of accuracy, robustness 
and versatility than is possible with existing systems. For instance, the location models provided include not only the radius- 
radius/TOA and TDOA techniques but also adaptive neural net techniques. Further, the present invention is able to adapt to the 
topography of an area in which location service is desired. The present invention is also able to adapt to environmental changes 
substantially as frequently as desired. Thus, the present invention is able to take into account changes in the location topography 
overtime without extensive manual data manipulation. 

Moreover, there are numerous additional advantages of the system of the present invention when applied in CDMA 
communication systems. The location system of the present invention readily benefits from the distinct advantages of the CDMA 
spread spectrum scheme, namely the exploitation of radio frequency spectral efficiency and isolation by (a) monitoring voice 
activity, (b) management of two-way power control, (c) provision of advanced variable-rate modems and error correcting signal 
encoding, (d) inherent resistance to fading, (e) enhanced privacy, and (f) multiple "rake" digital data receivers and searcher 
receivers for correlation of signal multipaths. 

Additionally, note that this architecture need not have all modules co-located. In particular, it is an additional aspect of 
the present invention that various modules can be remotely located from one another and communicate with one another via 
telecommunication transmissions such as telephony technologies and/or the Internet Accordingly, the present invention is 
particularly adaptable to such distributed computing environments. For example, some number of the location center modules may 
reside in remote locations and communicate their generated hypotheses via the Internet. 

In an alternative embodiment of the present invention, the processing following the generation of location estimates by 



13 



SUBSTITUTE SHEET (RULE 26) 



WO 98/10538 




PCT/US97/15933 



the modules may be such that this processing an be provided on Internet user nodes and the modules may reside at Internet server 
sites. In this configuration, an Internet user may request hypotheses from such remote modules and perform the remaining 
processing at his/her node. 

Of course, other software architectures may also to used in implementing the processing of the location center without 
5 departing from scope of the present invention. In particular, object-oriented architectures are also within the scope of the present 

invention. For example, the modules may be object methods on an mobile station location estimator object, wherein the estimator 

object receives substantially all target mobile station location signal data output by the signal filtering subsystem 20. 

Alternatively, software bus architectures are contemplated by the present invention, as one skilled in the art will understand, 

wherein the software architecture may be modular and facilitate parallel processing. 
10 One embodiment of the present invention includes providing the location of a mobile station (MS) using the digital air 

interface voice channel and an automatic caii distributor device. This embodiment provides location information to either the 

initiating caller who wishes to learn of his location, using the voice channel, and/or location information could be provided to 

another individual who has either a wireline or wireless telephone station. 



IS interface voice channel and a hunt group provided from a central office or similar device. This embodiment provides location 
information to either the initiating caller who wishes to learn of his location, using the voice channel, and/or location information 
could be provided to another individual who has either a wireline or wireless telephone station. 

Another embodiment of the present invention includes providing the location of a mobile station using the digital air 
interface text paging, or short message service channel and a hunt group provided from a central office or similar device. This 

20 embodiment provides location information to either the initiating caller who wishes to learn of his location, using the voice channel, 
and/or location information could be provided to another individual who has either a wireline or wireless telephone station. 

Another embodiment of the present invention includes providing the location of a plurality of mobile stations using the 
public Internet or an intranet, with either having the ability to further use "push", or "netcasting" technology . This embodiment 
provides location information to either the initiating Internet/Intranet user who wishes to learn of one or more mobile station 

25 locations, using either the Internet or an intranet. Either the mobile station user to be located can initiate a request for the user to 
be located, or an Internet/intranet user may initiate the location request. Optionally the location information could be provided 
autonomously, or periodically, or in accordance with other logic criteria, to the recipient of the location information via the 
Internet or a intranet. As a further option, location information can be superimposed onto various maps (e.g., bit/raster, vector, 
digital photograph, etc.) for convenient display to the user. 

30 Yet another embodiment of the present invention includes providing a multicast notification to a group of mobile 

station users, based on distress call from a particular mobile station, wherein the group of mobile station users are relatively 
nearby the distress caller. The multicast notification provides individual directions for each group mobile station user, to direct 
each user to the fastest route to reach the distressed caller. 



Another embodiment of the present invention includes providing the location of a mobile station using the digital air 



SUBSTITUTE SHEET (RULE 26) 



WO 98/10538 




PCT/US97/15933 



Further features and advantages of the present invention are provided by the figures and detailed description 
accompanying this invention summary. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. I illustrates an overall view of a wireless location system and method for using multiple commercial mobile radio 
service providers; 

Fig. 2 shows is a high level wireless location architecture using the intelligent network, which illustrates aspects of the 
home base station and Internet connectivity for receiving location requests and for providing location estimates; 

Fig. 3 illustrates how the signals from the base stations associated with various multiple commercial radio service 
providers an be shared with the wireless location system to provide an improved geometry and thus improved wireless location 
accuracy. 

Fig. 4 shows how the mobile station database in the location system is updated via interfaces in communication with 
multiple commercial mobile radio service providers using customer care systems. 

Fig. 5 shows a method of direct access to multiple CMRS base stations, from the location system perspective, thus 
avoiding the need to significantly modify network infrastructure systems. 

Fig.6 illustrates physical components and the effects of predetermined signal delay, and total system delay in a 
distributed antenna environment for purposes of wireless location; 

Fig. 7 shows the timing relationships among the signals within a distributed antenna system. 

Fig. 8 shows a flowchart of the methods and procedures required to implement a DA database; 

Fig. 9 illustrates an exemplary DA configuration with a direct antenna connection to the base stations; 

Fig. 10 illustrates an alternative DA configuration using multipoint microwave; 

Fig. 1 1 illustrates how multiple base stations could be used via a microwave circuit to provide PCS and location service 
to a multilevel building via virtual pilot channels; 

Fig. 12 shows the DA delay spread ranges possible for a 500 microsecond guard zone; 

Fig. 13 shows DA-cell layout a geometry and how location geometries can be constructed; 

Fig.14 illustrates the realization of actual measurements and classification utilized within DA cell ranges to determine a 
percent range within each cell. 

Fig. IS shows the standard components of a CDMA MS. 

Fig. 16 shows one embodiment for MS modification that facilities enhanced RF measurement telemetry. 

Fig. 17 shows how the LC is used in a Home Base Station architecture. 

Fig. IB illustrates a typical case where signals from three base stations can be detected. 

Fig. 1 9 illustrates a typical case where signals from four base stations (including remaining set information) can be 

detected. 

15 
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Fig. 20 shows a MS detection scheme with a two base station geometry. 

Fig. 21 illustrates a typical amorphous location area with only the signal detection of a single base station sector, by a 



MS. 



Fig. 22 shows a series of typical reverse path CDMA RF measurements in a dense urban area. 
Fig. 23 shows a series of typical reverse path CDMA RF measurements in a rural setting. 
Fig. 24 shows a typical Location Center connection to a CTIA Model. 
Fig. 25 shows a typical national Location Center and relevant network connections. 
Fig. 26 illustrates a typical three dimensional delay spread profile. 

Fig. 27 shows the magnifying effects of convoluting similar-property forward and reverse path three-dimensional 



10 images. 



Fig. 28 illustrates an image and relief representation of a CDMA Delay Spread Profile. 
Fig. 29 illustrates the main components of the Signal Processing Subsystem 20. 
Fig. 30 illustrates an image based on an RF signal measurement sample set, before image histogram equalization 
filtering is applied. 

15 Fig. 31 illustrates an image based on an RF signal measurement sample set, after image histogram equalization input 

cropping filtering is applied. 

Fig. 32 illustrates an image sample grid before image filtering. 

Fig. 33 shows a CDMA profile image after input cropping is used at a level of 50 percent. 

Fig. 34 illustrates the results of combining input cropping at 40 percent, then performing four by four median filtering 
20 on the resultant. 

Fig. 35 shows the results of combining input cropping at 50 percent with four by four median filtering. 

Fig. 36 illustrates how location estimates can be provided using voice channel connections via an ACD and Internet 

technology. 

Fig. 37 shows wireless Location of a MS using the Voice Channel from a Hunt Group. 
25 Fig. 38 illustrates how location information can be provided via Text paging or short message service messaging. 

Fig. 39 shows how location information of an MS can be provided via Internet via "Push" technology. 

Fig. 40 illustrates how location directions an be provided to nearest members, regarding directions for each individual 
member to reach a distressed MS caller. 

Fig.4l illustrates how traveling instructions from two different points can be provided to an initiator. 
30 Fig.42 illustrates how wireless location services can be used to facilitate automotive rental car tracking and control. 

Fig. 43 indicates the addition of a fuzzy logic module which discretizes the wireless location estimate output from the 
TOA/TDOA locaton estimator module. 



16 



SUBSTITUTE SHEET (RULE 26) 



WO 98/10538 




PCT/US97/15933 



DETAILED DESCRIPTION 

Various digital wireless communication standards have been introduced such as code division multiple access (CDMA) 
and Time Division Multiple Access (TDMA) (e.g„ Global Systems Mobile (GSM). These standards provide numerous enhancements 
for advancing the quality and communication capacity for wireless applications. Referring to CDMA, this standard is described in 
5 the Telephone Industries Association standard IS-95, for frequencies below I GHz, and inJ-STD-008, the Wideband Spread- 
Spectrum Digital Cellular System Dual-Mode Mobile Station-Base station Compatibility Standard, for frequencies in the 1.8 - 1.9 
GHz frequency bands. 

Additionally, CDMA general principles have been described, for example, in U.S. Patent 5,109,390, Diversity Receiver in a 
CDMA Cellular Telephone System, by Gilhousen. There are numerous advantages of such digital wireless technologies such as CDMA 

10 radio technology. For example, the CDMA spread spectrum scheme exploits radio frequency spectral efficiency and isolation by 
monitoring voice activity, managing two-way power control, provision of advanced variable-rate modems and error correcting 
signal design, and includes inherent resistance to fading, enhanced privacy, and provides for multiple "rake" digital data receivers 
and searcher receivers for correlation of multiple physical propagation paths, resembling maximum likelihood detection, as well as 
support for multiple base station communication with a mobile station, i.e., soft or softer hand-off capability. When coupled with 

15 a location center as described herein, substantial improvements in radio location can be achieved. For example, the CDMA spread 
spectrum scheme exploits radio frequency spectral efficiency and isolation by monitoring voice activity, managing two-way power 
control, provision of advanced variable-rate modems and error correcting signal design, and includes inherent resistance to fading, 
enhanced privacy, and provides for multiple "rake" digital data receivers and searcher receivers for correlation of multiple physical 
propagation paths, resembling maximum likelihood detection, as well as support for multiple base station communication with a 

20 mobile station, Le M soft hand-off capability. Moreover, this same advanced radio communication infrastructure can also be used 
for enhanced radio location. As a further example, the capabilities of IS-41 and AIN already provide a broad-granularity of wireless 
location, as is necessary to, for example, properly direct a terminating call to a mobile station. Such information, originally 
intended for call processing usage, can be re-used in conjunction with the location center described herein to provide wireless 
location in the large (i.e., to determine which country, state and city a particular mobile station is located) and wireless location in 

25 the small (i.e., which location, plus or minus a few hundred feet within one or more base stations a given mobile station is located). 
Fig. I illustrates a wireless location network using two commercial mobile radio service provider networks for the 
present invention. Accordingly, this figure illustrates the interconnections between the components of a typical wireless network 
configuration and various components that are specific to the present invention. In particular, as one skilled in the art will 
understand, a typical wireless network includes: (a) a mobile switching center (MSC) 12a; (b) generally a service control point 4a, 

30 and base stations (not shown) which are in communication with a mobile switch center 12a. Within a typical metropolitan area it is 
also common for a second commercial mobile radio service (CMRS) provider to offer wireless service within essentially similar 
coverage areas, such systems typically including an mobile switch center 12b, service control point 4b, and associated base stations 
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(not shown). Added to this wireless network, the present invention provides the following additional components: 

(I) a location system or center 42 which is required for determining a location of a target mobile station using 
signal characteristic values as measured by the target mobile station (not shown) and nearby base stations (not shown), further 
consisting of the following modules or subsystem components: 
5 (LI) an application programming interface 14, for physically interfacing with and controlling the messaging to and 

from each CMRS mobile switch center 12a, 12b, service control points 4a and 4b, receiving location requests from either the mobile 
switch center I2a ( or 12b, or the Internet 68, and providing connection to the signal processing subsystem 20; 

(\2) a signal processing subsystem 20, which is in communication with the application programming interface 
(API) 14. The signal processor 20 receives, queues, filters and processes signal measurement messages into various formats suitable 
10 for the location estimate modules DA 1 0 and TOA/TDOA 8; 

(13) a TOA/TDOA iocation estimate module 8, in communication with the signal processing subsystem 20. The 
TOA/TDOA module 8 provides a location estimate result, using a time of arrival or a time difference of arrival technique based on 
conditioned signals from the signal processing subsystem 20; in addition the TOA/TDOA module may also process signals from the 
distributed antenna module 1 0, in order to provide a location estimate within environments containing distributed antenna 
15 systems; 

(1.4) a distributed antenna (DA) module 10, which receives signals related to distributed antennas, from the signal 
processor 20 in communication a location estimating capability for utilizing one or more distributed antenna systems 168 as shown 
in Fig. 2, wherein each such system 1 68 provides wireless location information for an MS 140 within the area in communication 
with one or more distributed antenna system 168. 

20 (L5) a home base station module (HBS) 6 in Fig. I, which receives signals from the controller 14 and determines 

wireless location (i.e., providing a location estimate result) based on registration principles of the wireless user's mobile station 
when in communication with the user's home base station (not shown) in communications with a given service control point 4a or 
4b, containing ahome base station application (not shown). 

Since home base stations and distributed antenna systems can be located on potentially each floor of a multi-story building, 

25 in such cases where infrastructure is installed, the wireless location technology described herein can be used to perform location in 
terms of height as well as by Latitude and Longitude. 

Referring to Fig. 2, additional detail is provided of typical base station coverage areas, sectorization, and high level 
components used in the present invention's scope, including the mobile switch center 1 12, a mobile station 140 in communication 
with a home base station 160, and communication between the location system 42 and the public Internet 468, via an Internet 

30 service provider interface 472. A novel aspect of this invention includes providing wireless location estimate information to various 
designated users via the public Internet. Although base stations may be placed in any configuration, a typical deployment 
configuration is approximately in a cellular honeycomb pattern, although many practical tradeoffs exist, such as site availability, 
versus the requirement for maximal terrain coverage area. To illustrate, such exemplary base stations (BSs) 122a through 122g are 
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shown, each of which radiate referencing signals within their area of coverage to facilitate mobile station (MS) 140 radio frequency 
connectivity, and various timing and synchronization functions. A given base station may contain no sectors (not shown) , thus 
radiating and receiving signals in a 360 degree omnidirectional coverage area pattern, or the base station may contain "smart 
antennas" (not shown) which have specialized coverage area patterns. 

5 Alternatively and generally most frequent are base stations having three sector coverage area patterns. Shown in Fig. 2, 

each sector for base station 122a through I22g contains three sectors, labeled a, b, and c, which represent antennas that radiate 
and receive signals in an approximate 120 degree arc, from an overhead view. As one skilled in the art will understand, actual base 
station coverage areas generally are designed to overlap to some extent, thus ensuring seamless coverage in a geographical area. 
Control electronics within each base station are used to communicate with a given mobile station 140. Further, during 

10 communication with the mobile station the exact base station identification and sector identification information are known and 
are provided to the location center 142. 

The base stations located at their cell sites may be coupled by various transport facilities 176 such as leased lines, 
frame relay, T-Carrier links, optical fiber links or by microwave communication links. 

When the mobile station is powered on and in the idle state, it constantly monitors the pilot signal transmissions from 

1 5 each of the base stations located at nearby cell sites. As illustrated in Fig. 3, base station/sector coverage areas may often overlap 
both in the context of a single CMRS base station network, and also in the context of multiple CMRS base station networks, thus 
enabling mobile stations to detect, and, in the case of certain technologies, communicate simultaneously along both the forward 
and reverse paths, with multiple base stations/sectors, either with a single CMRS network or, in the case of hand-off s and roaming, 
multiple CMRS network equipment. In Fig. 3 the constantly radiating pilot signals from base station sectors 122a, 122b and 122c are 

20 detectable by mobile station 140 at its location. The mobile station 140 scans each pilot channel, which corresponds to a given base 
station/sector ID, and determines which cell it is in by comparing signals strengths of pilot signals transmitted from these 
particular cell-sites. 

The mobile station 140 then initiates a registration request with the mobile switch center 1 12, via the base station 
controller 174. The mobile switch center determines whether or not the mobile station 140 is allowed to proceed with the 
25 registration process (except in the case of a 91 1 call, wherein no registration process is required). At this point calls may be 
originated from the mobile station 140 or calls or short message service messages can be received from the mobile switch center 
112. 

As shown in Fig. 2, the mobile switch center 112 communicates as appropriate, with a class 4/5 wireline telephony circuit 
switch or other central offices, with telephone trunks in communication with the public switch telephone network (PSTN) 24. Such 
30 central offices connect to wireline stations, such as telephones, or any communication device compatible with the line, such as a 
personal or home base station. The PSTN may also provide connections to long distance networks and other networks. 

The mobile switch center 1 12 may also utilize IS/41 data circuits or trunks 522, which in turn connects to a service 
control point 104, using, for example, signaling system #7 (SS7) signaling link protocols for intelligent call processing, as one 

19 
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skilled in the art will understand. In the case of wireless advanced intelligent network (AIN) services such trunks and protocols are 
used for call routing instructions of calls interacting with the mobile switch center 1 12 or any switch capable of providing service 
switching point functions, and the public switched telephone network (PSTN) 24, with possible termination back to the wireless 
network. In the case of an mobile station 140 in communication with a corresponding home or office base station (HBS) 160, the 
5 HBS 160 controls, processes and interfaces the mobile station 140 to the PSTN 24, in a manner similar to a cordless telephone 
system, except that added AIN logic within, for example, the service control point (SCP) 104 is used to determine if the mobile 
station 140 is being controlled by the HBS 160 or a wireless base station 122. Regarding non-HBS calls, the mobile switch center 112 
may direct calls between mobile stations 140 via the appropriate cell site base stations 122 a through 1 22 h since such mobile 
stations 140 do not typically communicate directly with one another in such wireless standards as CDMA, TDMA NAMPS, AMPS and 
10 GSM. 

Referring again to Fig. 2 t the Location system 42 interfaces with the mobile switch center 1 12 cither via dedicated 
transport facilities 178, using for example, any number of LAN/WAN technologies, such as Ethernet, fast Ethernet, frame relay, 
virtual private networks, etc., or via the PSTN 24 (not shown). The location system 42 receives autonomous (e.g., unsolicited) 
autonomous or command/response messages regarding, for example: (a) the wireless network states, including for example, the 

15 fart that a base station has been taken in or out of service, (b) mobile station 140 and BS 122 radio frequency (RF) signal 

measurements, notifications from a SCP 104 indicating that an HBS 160 has detected and registered with the SCP 104 the mobile 
station 140 corresponding to the HBS 160, and (c) any distributed antenna systems 168. Conversely, the location system 42 
provides data and control information to each of the above components in (a) - (c). Additionally, the Location system 42 may 
provide location information to an mobile station 140, via a BS 122, using, for example the short message service protocol, or any 

20 data communication protocol supported by the air interface baetween the base station and the mobile station. Interface 1 06 
connecting the location system 42 with the service control point 104 may also be required in the event the home location register 
and/or the home base station AIN function is located in the SCP 104. 

Assuming the wireless technology CDMA is used, each BS 122a, 122b, 122c, through 122g uses a time offset of the pilot PN 
sequence to identify a forward CDMA pilot channel. Furthermore, time offsets, in CDMA chip sizes, may be re-used within a PCS 

25 system, thus providing efficient use of pilot time offset chips, thus achieving spectrum efficiency. 

The use of distributed antennas is another technique for improving or extending the RF coverage of a radio coverage area 
120 of a wireless system. Such distributed antennas are typically used in buildings or other areas of dense clutter, such as 
numerous walls, partitions and/or similar structures causing substantial signal attenuation. As shown in Figs. 6, 9 J 0, 1 1 , and 13, 
distributed antennas 168 are typically connected together in a serial fashion for communicating with one or more infrastructure 

30 base stations 122. Distributed atennnas may be connected to the mobile switch center 1 12 via various air interfaces, as shown in 
Figs. 10 and 1 1, or alternatively distributed antennas may be connected to the MSC via a directed connection to a base station 122 
as shown in Fig. 9, or via a private branch exchange (PBX) as shown in Fig. 13. 

Referring to Fig. 1 1, distributed antennas 168 are useful particularly in wireless system configurations involving 
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microcells, and potentially indoor environments, such as wireless systems in communication with private branch exchange systems 
(reference Fig. 13) in business offices, and in wireless local loop applications (not shown) as one skilled in the art will understand. 
Additionally, a distributed antenna embodiment can provide significant improvements in decreasing location error, as compared 
with an indoor mobile station 140 (reference Fig. 1 1) user with a wireless connection to an outdoor, infrastructure base station 122, 
5 as illustrated in Figs. 11,12, 13 and 14. 

MOBILE STATION DESCRIPTION 

As an example of a mobile station 140, such a mobile station will be described using CDMA technology. Fig. IS 
illustrates a typical block diagram of the functional components of a CDMA mobile station (MS) 140, based on the patent, 
"Diversity Receiver in a CDMA Cellular Telephone System", patent number 5,109,390. The MS 140 contains an antenna 510 coupled 

10 through diplexer 512 to analog receiver 5(4 and transmit power amplifier 516. Antenna 5!0 and diplexer 512 permit simultaneous 
transmission and reception of signals through an antenna 510. Antenna 510 collects transmitted signals and provides them through 
diplexer 512 to analog receiver 514. Receiver 514 receives the RF frequency signals, typically either in the 800-900 MHZ or 1.8-1.9 
GHz band, from diplexer 512, for amplification and frequency down conversion to an intermediate frequency (IF). Translation is 
accomplished through the use of a frequency synthesizer of standard design which permits the receiver 514 to be tuned to any of 

15 the frequencies within the designated receive frequency band. The IF signal is passed through a surface acoustic wave bandpass 
filter, typically of 1.25 MHZ bandwidth, to match the waveform of the signal transmitted by a base station 122. Receiver 514 also 
provides an analog to digital converter (not shown) for converting the IF signal to a digital signal. The digital signal is provided to 
each of four or more data receivers (520, 522, 524, and 526), one of which is a searcher receiver (526) with the remainder being 
data receivers, as one skilled in the art will understand. 

20 Analog receiver 514 also performs a open-loop type of power control function for adjusting the transmit power of the 

mobile station 140 on the reverse linkchannel. Receiver 514 measures the forward link signal strength of the signals from base 
stations 122, then generates an analog power control signal to circuitry in the transmit power amplifier 5 1 6, which can effect a 
range up to about 80 dB. The power control for the transmit power amplifier 5 1 6 is also supplemented by a closed-loop power 
control or mobile attenuation code (MAC) control parameter sent to the mobile station 140 via the air (i.e., wireless) interface from 

25 a BS 122, with either the CMAC or VMAC command (as one knowledgeable in CDMA standards will understand). The MAC can take on 
one of eight values 0 through 7, which effect a closed loop to raise or lower the power correction. The transmit amplifier 5 1 6 may 
utilize one of three transmit power classes when transmitting within a transmitted power control group in the 800-900 MHZ 
cellular band: class I (I to 8 dBW), class II (-3 to 4 dBW), or class III (-7 to 0 dBW), for a closed-loop range of about " 32 dB. In 
the PCS 1.8-1.9 GHz band five classes are defined: class I (-2 to 3 dBW), class II (-7 to 0 dBW), class III (-12 to -3 dBW), class IV (- 

30 17 to -6 dBW), class V (-22 to -9 dBW), for a closed-loop range of about " 40 dB. The mobile station 140 power class and transmit 
power level for a communicating mobile station 140 is known to the wireless infrastructure network, and may be utilized for 
location estimation, as is described hereinbelow. 
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The digitized IF signal may contain the signals from several telephone calls together with the pilot channels and 
muttipath delayed signals from each of several pilot channels. Searcher receiver 526, under control of control processor 534, 
continuously sans the time domain around the nominal time delay offsets of pilot channels contained within the active, candidate, 
neighboring and remaining sets of pilot channels. The initial sets of pilot channels and a defined search window size for each set are 
5 provided by a control message from a BS 122 via the air interface to the mobile station 140. The searcher receiver 526 measures the 
strength of any reception of a desired waveform at times other than the nominal time and measures each pilot channel's arrival 
time relative to each pilot's PN sequence offset value. Receiver 526 also compares signal strength in the received signals. Receiver 
526 provides a signal strength signal to control processor 534 indicative of the strongest signals and relative time relationships. 
Control processor 534 provides signals to control digital data receivers 520, 522 and 524 such that each of these 

10 receivers processes a different one of the strongest signals. Note, as one skilled in the art will understand, the strongest signal, or 
finger, may not be the signal of shortest arrival time, but rather may be a reflected, and therefore delayed, signal (such reflected 
denoted collectively as "muttipath"). Data receivers 520, 522 and 524 may track and process multipath signals from the same 
forward channel pilot channel offset or from a different forward channel pilot offset. In the case where a different pilot channel 
offset signal is of greater strength than the current cell site (or more specifically the current base station 122) pilot channel offset, 

15 then control processor 534 generates a control message for transmission on a reverse channel from the mobile station 140 to the 
current BS 122, requesting a transfer of the all, or a soft hand-off, to the now strongest cell site Base station 122. Note that each of 
the four receivers 520, 522, 524 and 526 can be directed independently from each other. The three data receivers 520, 522, and 524 
are capable of tracking and demodulating multipath signals from of the forward CDMA pilot channel. Thus data receivers 520, 522 
and 524 may provide reception of information via separate multipath signals from one BS 122 (e.g., in particular, an antenna face 

20 of a sectored antenna at the BS 122, or reception of signals from a number of sectors at the same BS 122, or reception of signals 
from multiple BSs 122 or their antenna faces of sectored antennas. Upon receiving a CDMA pilot measurement request order 
command, or whenever (a) the mobile station 140 detects a pilot signal of sufficient strength, not associated with any of the 
assigned forward traffic channels currently assigned, or (b) the mobile station 140 is in preparation for a soft or hard hand-off, 
then the searcher receiver 526 responds by measuring and reporting the strengths of received pilots and the receiver's definition of 

25 the pilot arrival time of the earliest useable multipath component of the pilot, in units of PN chips (one chip = 0.8 13802 

microseconds). The receiver 526 computes the strength of a pilot by adding the ratios of received pilot energy per chip E ( , to total 
received spectral density, l 0 , of at most k useable multipath components, where k is the number of data receivers supported in the 
mobile station 140. 

The outputs of data receivers 520, 522, and 526 are provided to diversity combiner and decoder circuitry 538 (i.e. ( 
30 simply diversity combiner). The diversity combiner 538 performs the function of adjusting the timing of a plurality of streams of 
received signals into alignment and adds them together. In performing this function, the diversity combiner 538 may utilize a 
maximal ratio diversity combiner technique. The resulting combined signal stream is then decoded using a forward stream error 
detection contained within the diversity combiner. The decoded result is then passed on to the user digital baseband circuitry 542. 
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The user digital baseband circuitry 542 typically includes a digital vocoder which decodes the signals from diversity 
combiner 538, and then outputs the results to a digital to analog (D/A) converter (not shown). The output of the D/A serves as an 
interface with telephony circuitry for providing mobile station 1 40 user analog output information signals to the user 
corresponding to the information provided from diversity combiner 53B. 
5 User analog voice signals typically provided through an mobile station 140 are provided as an input to baseband 

circuitry 542. Baseband 542 serves as an interface with a handset or any other type of peripheral device, to the user for audio 
communication. Baseband circuitry 542 includes an analog to digital (A/D) converter which converts user information signals from 
analog form into a digital form. This digital form is then input to a vocoder (not shown) for encoding, which includes a forward 
error correction function. The resulting encoded signals are then output to transmit modulator 546. 

10 Transmit modulator 546 modulates the encoded signal on a PN carrier signal whose PN sequence is based on the 

assigned address function for a wireless call. The PN sequence is determined by the controi processor 534 from caii setup 
information that was previously transmitted by a cell site BS 122 and decoded by the receivers 520, 522, 524 as one skilled in the 
art will understand. The output of transmit modulator 546 is provided to transmit power control circuitry 550. Note that signal 
transmission power is controlled partially by an open-loop analog power control signal provided from receiver 514. In addition, 

15 control bits are also transmitted by the controlling BS 122 in the form of a supplemental closed-loop power adjustment command 
and are processed by data receivers 520, 522,. In response to this command, control processor 534 generates a digital power 
control signal that is provided to the transmit power amplifier 516. Transmit power control 550 also provides the digitized and 
encoded user information signals in an IF format to output to the transmit power amplifier 516. The transmit power amplifier 516 
converts the IF format signals into an RF frequency by mixing this signal with a frequency synthesizer (not shown) output signal for 

20 providing a corresponding signal at the proper output transmission frequency signal. Subsequently, transmit power amplifier 516 
amplifies the signal to the final power output level. The transmission signal is then output from the transmit power amplifier 516 to 
the diplexer 512. The diplexer 512 then couples the transmission signal to antenna 510 for air interface transmission to the 
infrastructure base stations 122. 

Additionally, note that control processor 534 is also responsive to various control and information request messages 

25 from the controlling BS 122, including for example, sync channel messages, the system parameters messages, in-traffic system 

parameters messages, paging/alert messages, registration messages, status requests, power control parameters messages and hand- 
off direction messages, as one skilled in the art will understand. 

Referring still to a CDMA mobile station 140, in one embodiment of the present invention, the above-described standard 
CDMA mobile station architecture in an mobile station 140 is sufficient. However, in a second embodiment, this architecture may 

30 be modified in minor, cost effective ways so that additional information may be transmitted from an mobile station 140 to the BS 
122. The modifications for this second embodiment will now be described. The following modifications, either together or in any 
combination, provide improvements in location accuracy from the perspective of capturing RF measurement data: ( I) increasing 
measurement quantity, ( 2) improving measurement transmission, ( 3) extending the pilot set and search, ( 4) extending the pilot 
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signal reporting capabilities, 5) decreasing the Quantization size of the units used to report the pilot PN phase arrival time, 6) 
improving the accuracy of the mobile and base station time reference, and 7) increasing the number of data receivers and related 
circuitry, for correlation tracking of a larger plurality of pilot channels and each of their multipath signals. 

Using the standard system parameters overhead message in the paging channel as one method of reporting to the base 
station the signal strengths and delays of detectable pilot channels, a mobile station has various timers indicating the upper bounds 
of time needed to respond to a request, and to bid for access to the forward channel (if not already using it's assigned traffic 
channel). These timers restrict the frequency of measurement reporting and thus limit the aggregate amount of measurement data 
which can be sent in a given time period. 

For example, CDMA standard timer T 33m establishes the maximum time of a mobile station to enter the update overhead 
information substate of the system access state to respond to messages received while in the mobile station idle state, typically 03 
seconds. Timer T S6m , the maximum time for the mobiie station to respond to one service option request, is typically 0.2 seconds. 
Thus during a period of about five seconds, this measurement reporting method would provide for a maximum of about fifteen 
measurements. 

However the same CDMA receiver design infrastructure, with slight circuitry modification can be used to support 
improved measurement transmission. 

In order to collect a data ensemble of RF measurements that represents a statistically significant representation of data 
values in a geographical area of interest, it is the intention that the second (CDMA) mobile station 140 embodiment be capable of 
sending to the network base station infrastructure approximately 128 samples of each multipath peak signal strength and its 
relative delay, for each detectable pilot channel, in less than a preferred period of about five seconds. In order to transmit this 
amount of data, other means are needed to efficiently send the needed data to the network (i.e., from the mobile station to the 
base station, and then to forward data to the wireless switch, and then to forward data to the Location Center). 

The CDMA air interface standard provides several means for transmitting data at higher rates. The Data Burst message 
can be used, or various blank-and-burst, dim-and-burst multiplex options can be used, and well as selecting various service options 
2 through 9, through the setup of a normal voice or data telephone call. In one embodiment, , the user dials a speed number 
representing a data-type call to the Location Center 142, which initiates a command to the mobile station 140, responsive by the 
mobile station 140, which then provides the location center 142, via the base station 122, mobile switch center 1 1 2 with the needed 
measurement data. 

Referring to Fig. 16, in one embodiment a software controllable data connection or path 49 is established between the 
control processor 46, and the user digital baseband 30 functional components in the mobile station, a much larger quantity of RF 
measurements, on the order of 128 data samples, can be transmitted as a data burst, multiplexed, or sent by other means such as a 
data circuit call, back to the network, and to the Location Center. Note that the existing connection between the control processor 
534 and the transmit modulator 546 may also be used, as well via any other virtual path, such as software register-to-register 
move instructions, as long as sufficient signal measurement content and data samples an be sent to the wireless network and the 
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location center 142 via the associated interfaces. Those skilled in the art will understand the wireless network consists of the base 
station, mobile switch center, and related infrastructure equipment, interfaces and facilities circuits to telemeter the measurement 
content and data samples to the location center 142. Additional design issues include, for example, the fact that existing memory in 
the mobile station must be allocated to the temporary storage of RF sample measurements, and new control means, such as 
selecting a future use control bit pattern in the CDMA air standard, are required to telemeter, preferably upon command, RF 
measurement sample data to the Location Center 142 in Fig. I. In the case where a location request is received by the location 
engine 139 in the location center 142, the location engine 139 initiates a message to the mobile station 140 via a signal processing 
subsystem and the location center mobile switch center physical interface, the location applications programming interface 136 for 
the mobile switch center 1 12 and the wireless network infrastructure. 

The addition of a controllable data connection or path 49 can be easily performed by CDMA application-specific 
integrated circuit (ASIC) manufacturers. In the case of one ASiC manufacturer known to the authors, the Qualcomm ASIC chip 
mobile station modem, model number MSM 2300, provides both the control processor function 534 and the user digital baseband 
542 functions or the same chip, thus the external pinout physical configuration would not have to change to accommodate the 
wireless location software controllable data connection or path 49 modification. 

If the mobile station 140 searcher receiver detects 4 pilots with 4 multipaths each, with each measurement consisting of 
a pilot index, finger identification, multipath signal strength, and multipath arrival time, then about 480 bytes are needed per 
measurement. Assuming the searcher receiver performs one measurement every 10 mS, about I second is needed to compile and 
buffer each sample of 128 measurements per sample, or about 48 kilobytes. Using a typical 9600 kbps CDMA data channel between 
the mobile station 140 and a BS 122, and assuming a 50 percent overhead, the mobile station can complete the collection and 
transmission of a location measurement sample in less than ten seconds, which is within a reasonable period for satisfying a 
location request. 

The implementation of the data services required to telemeter the necessary signal measurements may be performed in 
any of several embodiments. In one embodiment the location signal measurements request-response application message set 
utilizes the air interface services provided by the spare bits and digital control words not currently in the air interface standards IS- 
95 and ANSI-J-STD-008. Such bits and control words can be reserved for the purpose of requesting and providing the required 
location signal measurements discussed herein. Using this embodiment the base station and mobile switch center must be modified 
to support the interworking function required between the location center and the mobile station. In a second embodiment the 
location signal measurements request-response application message set is implemented using service options 4 and 12, which 
provides asynchronous data transmission capability, as defined in TR45 Data Standard, Async and 'fax Jm/iw, document number 
TIA/EIA/IS-DATA.4. Using this second embodiment, the mobile station control processor provides, or would interface with a 
function emulating mobile termination 0 or 2 services at the R m network reference point The L-API then provides, or would 
interface with a function emulating the physical interface connecting a data circuit-terminating equipment (DCE) to the PSTN at 
the W network reference point, in communication with the PSTN, which is also in communication with reference point Ai, which is 
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in communication with reference point l) m , which is in turn in communication with reference point R^. An advantage of this 
embodiment is that no ASIC or circuit board modifications are needed in the mobile station. 

The ANSI standards J-008 and IS-95 provide several means for the base station 122 to establish and to extend the 
search window size that the mobile station 140 should use in its scanning process, and to identify further pilots. For location 
5 purposes, either existing standard parameters can be extended, or a location message request from the Base station can inform the 
searcher receiver of the mobile station to extend its search range, as necessary, to capture all relevant base station pilots and their 
multipath fingers, in order to complete the location measurement sample. 

The search performance criteria defined in ANSI IS-98, Recommended Minimum Performance Standards for Dual Mode, 
can be increased as appropriate to accommodate a larger set of potentially detectable base stations, including Location Base 
10 stations and Mobile Base stations. Additionally the search window table size for various search window values must be increased to 
accommodate new pilot channel pn-offsets associated with Location Base Stations and Mobile Base stations. 

Existing standard parameters include, for example using the In-traffic System Parameters Message, the values 
SRCH_WIN_A (for active and candidate set), SRCH_WIN_N (for neighboring set), and SRCH _SIN_R (for remaining set) can be 
used to cause the searcher receiver to increase its search area to detect and thus measure as many pilots as can be detected in the 
15 area. Extending the range of T_ADD and TJ)R0P parameters an also be used to facilitate the mobile to retain data on additional 
pilots in the area. The extended neighbor list message is used to inform the mobile station of the necessary characteristics of 
neighboring pilot signals. For example if location base stations are used on a different frequency assignment, and/or utilize unique, 
non-public pilot PN sequence offset indices, for example, in using increments other than 64 PN chips, then the extended neighbor 
list message can be used to instruct the mobile station to scan for those types of base stations, accordingly. 
20 There can be several combinations of delay spread signal strength measurements made available to the location center, 

from the mobile station 140. In some cases the mobile station 140 may detect up to three to four pilot channels (representing 3-4 
base stations), or as few as one signal from one pilot channel. 

For each pilot channel detection case, multiple, up to three to four fingers, or multipath signals may be detected per 
pilot channel. 

25 Note that multiple multipath signals, or multiple "fingers" could exist from a less-strong BS pilot signal, or in any of 

several combinations, which can depend widely upon the mobile station's location within the base station environment. 

By modifying the CDMA Base station, mobile station and controller capabilities to provide the location center 142 with 
data that exceeds the 1:1 fingers to data receiver correspondence, additional information can be collected and processed in order to 
further improve the accuracy of the location estimate. A control message from the location center 142 and carried through the 
30 network, is sent to the control processor in the mobile station, requiring the searcher receiver in the mobile station o transmit to 
the location center 142 via the network, all detectable delay spread fingers related to each detectable pilot channel. 

In one embodiment the control message is implemented in the CDMA receiver via a multiplexing technique, including 
appropriate manipulation of the hand-off parameters T_ADDs, TJJROPs, search window and the active, neighbor and remaining 
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pilot jets held within the mobile station' memory. 

Although the CDMA ANSI J-STD 008 requires reporting of the pilot channel arrival time in a time period of units of one 
chip size, or 813.802 nanoseconds, typical CDMA receivers contain an internal Quantization interval of one eighth chip size. 

Within the mobile station, by modifying the time of arrival message response message to output the delay value in unit 
5 increments of one-eighth chip size, the precision of location accuracy can be increased from about 800 feet in radius to about 1 10 
feet. At the base station the arrival time measurement is forwarded in one-eighth units to the Location Center. A multiplier function 
applied to the received measurement at the base station rescales the measurement for routine CDMA control and monitoring 
purposes, in order to be consistent with the CDMA standard. In order to distinguish among several mobile station models which 
report arrival time in either one-eighth chip units or one chip unit sizes, an encoding can be used in the mobile station's hardware 

10 or software identifications, telemetered to the base station and Location Center, in order to determine the arrival time 

measurement units, in one embodiment the anaiog receiver in the mobile station utilizes a dock signal which runs eight times 
faster than the clock originally disclosed in the Gilhousen patent, number 5,109,390. In this manner the digital signal provided to 
the data receivers and the searcher receiver will include an improved resolution in ability to detect delay spread signals, which are 
directly used to improve wireless location. 

1 5 Although the CDMA air interface standard only requires a 1 ,000 nanosecond tolerance accuracy within respect to the 

base station, location accuracy an be improved if manufacturing calibration precision's are held to within tighter tolerances, such 
as less than 250 nanoseconds. However in any given location request, as long as the base station to base station tolerances are 
tuned properly to an amount less than 500 nanoseconds, then very good location estimates can be performed due to the self 
canceling time effect geometries typically present in multi pilot channel detection found in urban and suburban areas. 

20 Increasing the typical number of data receivers in either the mobile station or base station provide added capabilities to 

lock and track more delay spread fingers and respective base station pilot channels. The resulting additional information, if 
available in a given radio coverage area 120 in Fig. I, can be used for enhanced location estimate accuracy due to confluence or 
voting methods which can be deployed at the Location system 142. 

In certain cases wireless location signals are received representing distributed antennas (or other base stations) across 
25 building floor boundaries being received from a specific floor on a multi-storied building. As a specific example, consider signals are 
being received from both the 40th and the 41th floor; the objective is to resolve the ambiguity of the situation. Fuzzy logic is used 
to resolve this ambiguity. The determination as to which floor the user of the mobile station is on is based on the strength of the 
signal, S, and the past reliability of the information associated with the two antennae, R. The spaces of S and R are discretized using 
fuzzy sets. The strength is defined as being: (I) VERY STRONG (VS), (2) STRONG (S), (3) WEAK (W), and (4) VERY WEAK (VW) as 
30 defined by membership functions. The reliability of information is defined as being: (I) VERY RELIABLE (VR), (2) RELIABLE (R), 
and (3) NOT RELIABLE (NR), again as defined by membership functions. A fuzzy relation or mapping is described which descretizes 
how confident it is that the signal is coming for a given floor, e.g., the 40th floor, using the following notation: 
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VR 
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NR 
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0.0 



The above relation matriz is read, for example, that when the signal information is RELIABLE and the strength is WEAK, 
then the confidence that the signal is coming from the 40th floor is 0.4. A similiar fuzzy relation matrix is established for the 
distributed antenna on the 41st floor, and thus the result would be a confidence factor associated with the mobile station being 
5 located on either fioor. A singie solution, that is, whether the mobile station is on the 40th or 4i st floor is determined using a 
compositional rule of inference. The compositional rule of inference is a function that prescribes a mechanism for consolidating 
mambership function values into a single crisp function. This function can take a variety of forms including max-min composition, 
max-product composition, etc. The compositional rule of inference can be implemented, for example, by a summing junction which 
collects the results of each firing rule. The summing junction's output is then provided to a centroidal def uzzier which provides the 
10 discretized output. 

Fig. 43 indicates the addition of a fuzzy logic module 41 which optionally discretizes the wireless location estimate 
output from the TOA/TDOA locaton estimator module 8. In the above case fuzzy logic rules related to the distributed antenna 
relation matrix would be fired or activated as a result of exmining the message header data structure that indicates that the 
location estimate was the result of a distributed antenna case around the 40th and 41st floor of a particular building within which 
15 such fuzzy relations exist or in any other localized case sherin such fuzzy relations have been predetermined. Otherwise, in cases 
where no such fuzzy rules apply, the location estimate is passed to the recipient without further discretization. 

Note that the confidence associated with the location of the mobile station can be considered a function of several 
variables, not just the two (S and R) described above. For instance, it would not be unreasonable to segregate the reliability 
information by time signal delay as determined within this invention. The fuzzy relation is capable of handling a variety of such 
20 situations. Thus which floor the mobile station is on can be considered to be a function of numerous variables; the ultimate decision 
can be made based on a great deal of information. 

LOCATION CENTER - NETWORK ELEMENTS API DESCRIPTION 

A location application programming interface 14 (Fig. I), or L-API, is required between the location system's 42 signal 
processor 20 and the mobile switch center 12 network element type, in order to send and receive various control, signals and data 
25 messages for wireless location purposes. The L-API is implemented using a preferably high-capacity physical layer communications 
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interface, such as IEEE standard 8023 (10 base! Ethernet), although other physical layer interfaces could be used, such as fiber 
optic ATM, frame relay, etc. Two forms of API implementation are possible. In the first case the signals control and data messages 
are realized using the mobile switch center 112 vendor's native operations messages inherent in the product offering, without any 
special modifications. In the second case the L-API includes a full suite of commands and messaging content specifically optimized 
5 for wireless location purposes, which may require some, although minor development on the part of the mobile switch center 
vendor. A minimum set of L-API message types include: 

A first message type, an autonomous notification message from the mobile switch center 1 12 to the location system 42, 
is required in the event a wireless enhanced 9-1-1 call has been sent to the mobile switch center from an mobile station 140, 
including the mobile identification number (MIN), along with various CMRS identification and mobile station detected active, 
10 candidate, neighbor and remaining pilot set information, pilot strength measurements message; 

A second message type, forward path request-response message, from location system 42 to mobile switch center 1 12, is 
required to request a mobile station (MS) for signal measurements and hand-off information, with a response message back from 
the mobile switch center 1 12 to the location system 42, along with various CMRS identification; 

A third message type, Reverse path request-response message, from location system 42 to mobile switch center 1 12, to a 
15 BS for signal measurements received at the BS and hand-off information, for a given mobile station MIN, along with various CMRS 
identification. It is preferable for the received signal strength measurements performed at the mobile station along the forward 
path, and at the base station along the reverse path, to be reported in a variable-length data structure as follows: for each pilot 
channel offset, include the phase of the earliest arriving usable multipath component pilot PN sequence relative to the zero offset 
pilot PN sequence of this pilot, termed pilot PN phase or pilot arrival, in units of one-eighth PN chip, instead of units of one PN chip 
20 as stated in the standards. Furthermore, in accordance with the standards, the pilot strength shall be included, measured based on 
at most k usable components, where k is the number of demodulating elements supported by the receiver system. In addition the 
total number of each detectable multipath components shall be reported. In addition each multipath component, for a given pilot 
shall be identified by both its delay component and signal strength, for inclusion in the signal measurements to the location system 
42. Regarding each individual multipath component, signal strength is expressed as is commonly known, by adding the ratios of 
25 received pilot-multhpath component energy per chip, E t , to total received spectral density (noise and signals), i 0 of at most that one 
mutipath component (i.e., k is equal to one). 

A fourth message type, an autonomous notification message from the mobile switch center 1 12 to the location system 
42 is required, in the event of an mobile station hand-off state change, along with various CMRS identification. 

In order to implement additional location functions such as wide area location, wherein location is determined across 
30 roaming boundaries, out-of-coverage area conditions or mobile station 140 turned off, and home base station applications, the L- 
API must include access to and receive data from a data store contained in the home location register (HLR) network element type 
associated with the mobile switch center 112. 

A fifth message type is required which provides the location system 42 with the mobile station MIN, hand-off, along 
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with various CMRS identification information (eg., old and new state changes, old and new BS identifications, and hand-offs to 
another CMRS), roaming location and status changes. A typical communications protocol such as Signaling System number 7, 
running on a V35 communications channel could be used for implementation, but numerous other protocols (e.g., TCIP/IP, ROSE, 
CMISE, etc.) could be used to implement this capability. If the home location register is local to the mobile switch center 1 12 then 

S the LC - mobile switch center communications link could be used, otherwise a separate communications link is used between the 
location system 42 and the home location register. 

A sixth message type, an autonomous notification message type issued from the location system 42 to the home 
location register, is required for those location applications they rely on an alert from the home location register when ever a 
particular mobile station state change occurs, along with various CMRS identification. Consider the case wherein an mobile station 

10 140 whose location is to be tracked constantly. In such cases a history of locations is maintained in the location system 42. Should 
the mobile station 140 user turn off the power, or exit from the coverage area, then by using previous location values a vector and 
approximate velocity can be determined. This sixth message type provides a notification message from the home location register to 
the location system 42 whenever a previously identified mobile station MIN has a state change. Examples of a state changes include 
cases where the base station 122 discovers the mobile station 140 has traveled to another base station, or that the current primary 

15 base station 122 can no longer communicate with the mobile station 140 (i.e., no power), or that a new registration has occurred. 
In general this message type should support the notification from the home location register to the location system 42 of all 
messaging and data associated with the nine types of registration, in the case of CDMA. Specifically these include power-up, power- 
down, timer-based, distance-based, zone-based, parameter-change, ordered, implicit and traffic channel registration. The location 
system 42 should also be informed of the registration enablement status of each type of registration, which can be provided to the 

20 location system 42 via a redirection of the systems parameters message. It should also be possible for the location system 42 to 
initiate an ordered registration through an order message, from the location system 42 to the mobile switch center 112. The mobile 
switch center 1 12 then shall route the message to the appropriate base station, and then to the mobile station. The location system 
42 should also be able to receive the results of the message. 

In order to implement additional location functions such as providing users with location information and routing 

25 instructions to certain locations via the wireless short message text paging service, an L-API is required between the location system 
42 and the network element type used to implement the short message service. Such network elements may be termed an intelligent 
peripheral or a service node. A number of existing paging interfaces have been proposed in standards bodies, and one or more 
modifications can be made to accommodate L-API content. In any case, the following L-API addition is required: a seventh message 
type which allows the location system 42 to send a text message containing location information or instructions to a particular 

30 mobile station MIN, and a related message to verify response. Optionally another, ninth message type, an autonomous message 
may be provided to alert the location system 42 under conditions wherein a state change occurs on a previously pending text 
message. This last message type provides improved quality feedback to the initiating party regarding the acceptance situation of 
the attempted-to-send page. 
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UTILIZING MULTIPLE CMRS INFRASTRUCTURE IN A SHARED COVERAGE AREA 

As a consequence in practical deployment situations that base stations are not placed in a uniform manner in a 
geographical area, and the fact that variable and fixed clutter introduce a variety of signal measurements which can result in the 
5 provision of an ambiguous location estimation, a novel aspect of this patent includes the utilization of the inherent ability of the 
wireless protocol and receiver design to request and receive signal measurements along the forward and reverse air interface 
communications path with a given mobile station and other commercial mobile radio service providers, in cases where multiple 
service providers share a common coverage area. Thus in a coverage area shared by two service providers A and B, utilization of 
received signal measurements from both service provider A and service provider B can be used by the location center as unique, 
10 orthogonal information to both resolve ambiguous location estimates and to further improve the location estimate accuracy. 

The CDMA air interface, for example, provides a soft hand-off capability for the mobile station to hand-off a voice 
communication channel to another base station, and even to another CMRS provider, termed a hard hand-off. 

Referring to Fig. 3, assume three sectored base stations 122a, I22b, and 122c, in communication with mobile switch 
center-A 1 12a, are owned and operated by CMRS provider A. further, assume three sectored base stations I22d and I22e, in 
15 communication with mobile switch center-B 1 12b, are owned and operated by CMRS provider B, and that the coverage area with 
CMRS-A and CMRS-B substantially overlap. In order to locate a mobile station 140 whose subscriber normally does business with 
CMRS provider A, assume that the receiver of mobile station 140 can detect signals from base stations 122a, 122b, and 122c, as well 
as from base stations I22d and I22e, although normal mode use would preclude such measurements from being initiated. Assume 
further that the resulting location estimate 131, generated from the location center 120 contains either an ambiguous location 
20 estimate value pair, or otherwise cannot render a location estimate with the desired range of accuracy. 

From an inspection of the overall base station geometry of base stations owned by CMRS A and CMRS B it is evident that 
a strong possibility exists that either I.) the receivers in mobile station 140 have the possibility to detect the pilot channels 
associated with base stations I22d and I22e; 2.) the receivers in base stations 1 2 2d and I22e have the possibility to detect the 
transmitter signal from mobile station 140. The location system 142 contains a data store of both CMRS provider's base station 
25 geometeries and is in communication with each mobile switch center - A 1 12a and mobile switch center - B 1 12b. An application in 
the location system 142 sends a control message to the mobile station 140, instructing the mobile station to tune its searcher 
receiver to listen for and report back signal measurement data regarding the pilot channel information associated with base 
stations I22d and I22e, in addition to a request to report of pilot signals relative to base stations 122a, 122b, and 122c. Similarly 
the application in the location system 142 sends messages to each of base stations 1 2 2d and I22e, with instructions to take signal 
30 measurements and report back the resulting information regarding the mobile stations transmitter 140. Since the signaling 

information from base stations I22d and I22e are based on a substantially different location geometry, the resultant information is 
orthogonal and thus can be used by the location center to provide enhanced location estimates. 
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If appropriate, a variation of the above process includes a location center initiated forced hard hand-off of the mobile 
station from a primary base station, e.g., 122b associated with CMRS-A, to a new primary base station associated with CMRS-B, e.g., 
I22d. A forced hand-off will further provide improvements in reducing systemic timing errors which may be inherent among base 
stations owned by different CMRS. After the appropriate signal measurements have been reported the location system 142 can 
5 revert the hand-off back to the original CMRS. Other location system components shown in Fig. 3 include a controller 14 location 
applications programming interface 136 (L-API-MSC) for communications interface with multiple CMRS mobile switching centers, 
via physical interfaces 176a and 176b. 

In order to provide the most economically efficient and accurate wireless location service capabilities among multiple 
CMRS providers in a shared coverage area, a common location applications programming interface (L-API) is highly desirable. A 

10 common interface also supports the natural competitive behaviors among wireless consumers and CMRS by providing flexible 
relationships among consumers who may want to switch service providers, yet retain consistent wireless location services for public 
safety. This approach minimizes the L-API design and deployment costs among infrastructure vendors and location service 
providers in a shared coverage area. Based on a L-API between a wireless location center and the mobile switch centers of multiple 
CMRS, a novel aspect of this invention further includes a method and process that provides account management clearing house and 

IS revenue settlement capability with appropriate security management controls. This capability is implemented as wireless location 
control, accounting and security mediation agent functions to compensate CMRS providers for providing various location-specific 
network services as described herein. 

As wireless location requests are sent to the location center for a given CMRS, operated by a wireless location service 
provider (WLSP), this agent: I.) assesses the appropriateness of soliciting additional signal and control measurements from another 

20 CMRS' base station in the same coverage area, in order to improve the quality of the location estimate, 2.) Accesses, requests and 
receives signal and control information with another CMRS base station infrastructure, 3.) provides as appropriate a record of 
compensation entitlement between or among multiple CRMS and WLSPs, and 4.) security management controls thai protect the 
privacy needs of wireless customers and the unauthorized sharing of information between or among CMRS. Security controls also 
include audit trails and controls regarding customer access of their location subscriber profile and the administration of network 

25 security processes and related base station parameters and inventory. 

Referring to fig. S, Location Center-base station access, multiple CMRS, an alternative embodiment is provided to 
extract the wireless location signal measurement data from each base station associated with each of multiple CMRS. Given base 
station I22i and I22j are operated by CMRS-A and base station 122k and 122m are operated by CMRS-B, a communication circuit 
provides connectivity with the location application programming interface - base station (L-API-BS) 1 09. The L-API-BS 1 09 is in 

30 communication with controller 14 in the location center 142. The communications circuit can be any of several conventional 
transport facilities, such as a private line circuit, a DS-I or T-l carrier circuit, frame relay circuit, microwave circuit, or other data 
communications circuit. 

The advantage of this embodiment is that no modifications are required by the infrastructure vendor in terms of the 
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embedded operations circuit, and related functions and systems which otherwise would be needed to telemeter wireless location 
signal measurement data from the base station to the location center 142. The termination equipment (not shown) in 
communication with the transport facilities, within each base station typically includes a small computer with an in-circuit 
connection, such as an ASIC clip-on device, with connections to the control processor circuitry with the base station in the receiver 
section. The small computer provides a conversion of the signals provided on the in-circuit connection to the ASIC chip, for 
serialization and transmission to the location center via the transport facilities. 



HOME BASE STATION DESCRIPTION 

The Home Base station (HBS) concept in the PCS wireless network environment allows a user's mobile station to be also 
10 used as a low cost cordless phone, whenever the mobile station is physically near (generally within 700-1,000 feet) of a Home Base 
station Device (HBSD). This enables the user to avoid the typically higher cost air time charges associated with traditional wireless 
service. 

The HBSD is similar to ordinary cordless phone transceiver devices in current use today, but is modified to function with 
a PCS wireless mobile station. Although the HBSD has been typically used at a residential consumer's home, the HBSD could also be 
15 used in business settings and other environments. 

When a mobile station (MS) is near the HBSD as shown in Fig. 17, and the HBSD detects the presence of a mobile 
station over the Cordless phone air interface, the HBSD signals the Home Location Register (HLR) software in the Service Control 
Point in the AIN network associated with the mobile station and mobile station's home mobile switch center. The home location 
register redirects mobile station terminating calls from the network away form the mobile station* mobile identification number in 
20 the mobile switch center, and to the AIN/SSP wireline class V switch which connects the wireline number associated with the HBSD. 
Similarly, the HBSD, upon detecting a mobile station call origination attempt, redirects the mobile station signal from a PCS 
network fixed base station, to the control of the HBSD. The HBSD redirects the mobile station originating call through the wireline 
network, similar to any other wireline network all. 

A reverse scenario occurs whenever the mobile station and HBSD lose communication: the mobile station registers in a 
25 wireless PCS network fixed base station, causing redirection of calls to the wireless network. The cordless phone air interface may 
be of a vendor proprietary design, or it may be a similar design as the CDMA air interface. 

In order to perform a location estimate in the HBS concept, a connection is used between the Location Center (LC) and 
the home location register/HBS application in the SCP. In addition, a new process, termed a Location Notification Process (LNP) 
within the home location register/SCP is used to send a message to the LC, autonomously whenever a state change occurs in the 
30 mobile station' (either via a specific list of mobile identification numbers or all mobile identification numbers) registration: 
registering either to a fixed Base station in the Wireless PCS network or to a HBSD. 

Alternatively the process may respond to an on-demand message from the LC to the LNP within the home location 
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register/HBS application. In either case a response message from the LNP to the LC provides the information regarding whether or 
not a mobile station is within range of its, or a designated HBSD. In either case the response message contains a message header 
information which provides the signal processing subsystem 20 (equivalent^ this may be known by signal filtering subsystem) 
with the ability to determine and distribute the information to the HBS First Order Location Estimate Model. 

5 

LOCATION USING DISTRIBUTED ANTENNAS DESCRIPTION 

CDMA distributed antennas are useful particularly in system configurations involving microceils, and potentially indoor 
environments, such as CDMA PBX (private branch exchange) systems in business offices, and in wireless local loop applications. 
From a mobile station location perspective, the distributed antenna configuration can provide significant improvements in location 
10 error, as compared with an indoor mobile station user with a wireless connection to an outdoor, macrocell Base station. Wireless 
location can be achieved provided certain methods and procedures (M8Ps) are followed during the installation process. Data 
related to these M&Ps is then used by various location processes discussed elsewhere in this invention. 

First, a general description of CDMA distributed antennas is presented, followed by the M&Ps necessary to support 
wireless location. 

15 In the CDMA distributed antenna concept, a set of simple antennas, placed apart in a given area, similarly to any other 

cell placement arrangement for coverage objectives, are fed by a common radio signal. Antennas are usually placed such that their 
coverage patterns are substantially or completely overlapped in area of coverage. From a wireless location perspective, completely 
overlapping coverage is preferred (this approach also improves perceived signal quality by the end users). 

The importance of understanding and characterizing the aggregate system delay elements is shown in Fig. 6: Distributed 

20 Antenna Delay Characterization. For any given Pilot Channel offset "I", additional delay is introduced by the microwave 

propagation channel (Point A) and any internal repeater/amplifier equipment (Point B). Each of four delay elements t. through t 4 
introduce further delay. A mobile station detecting all four DA antennas' delayed signals would determine various sets of 
cumulative system propagation delays. Since each delay is essentially fixed in a location, such information can be used to determine 
the mobile station location within the building. Fig. 7 illustrates the effective system timing among the delay elements 324, relative 

25 to the GPA system time 336, along each point in the diagram shown in Fig. 6. 

Fig. 9: One Exemplary DA Configuration, illustrates a typical configuration where the CDMA base station antenna is also 
directed connected to three delay elements and antenna radiators. 

The CDMA Base station transmitter common output signal is fed through a distribution coaxial cable system, optical 
fibers or other means, to a string of two or more antennas. Each antenna is connected to the distribution cable via a transmission 

30 line tap or delay element, which may or may not provide further broadband gain. The transmission system normally consists of two 
media channels, one for transmit and one for receive signals. Fig. 10 illustrates an Alternative DA Configuration, using multi-point 
microwave antennas connected to individual delay elements and their respective radiating antennas. 
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Fig. II: Serving Dense Multi-level buildings via Virtual Pilots, illustrates a typical application where a multi-level 
building is served by two base stations with pilot offsets T and M j n - Pilot offset "I" serves floor X and pilot offset "j" serves floor 
Y. As shown, a microwave link, either active or passive, relays the base station signals between the distributed antennas within the 
building to the base stations. 

S The main concept is to introduce purposeful delay and multipath signals with sufficient delay spread for signal 

discrimination. Each antenna radiates a signal which is substantially delayed with respect to any other antenna in the area. If two 
or more paths are available for the mobile station receivers with greater than one eighth microsecond differential path delay (or 
whatever resolution is available in the CDMA mobile station receivers), then two or more PN receivers in the same mobile station 
can be employed to separately receive and combine these signals and thus achieve processing gains through path diversity. 

1 0 Antennas may be omni-directional or directional. 

Delay elements may be simple delay lines such as lengths of coaxial cabling, or other active or passive delay elements, 
such that the combination of components provides the needed delay. The transmission line between the CDMA Base station/PBX and 
the distributed antennas may be via a pair of dedicated, beam-focused high gain antennas, and/or a repeater system. Provided 
sufficient delay exists between the multipath signals from separate distributed antennas exists, each Data Receiver within the 

IS mobile station tracks the timing of the received signal it is receiving. This is accomplished by the technique of correlating the 
received signal by a slightly earlier reference PN and correlating the received signal with a slightly late local reference PN. Further 
distributed antenna details can be seen from Gilhousen, et al, patent number 5,280,472, assigned to Qualcomm, Inc. 

The total measured delay of both forward and reverse link signals between the BS and the mobile station are thus 
determined naturally by the CDMA radio receiver designs as a part of the multipath tracking process, and can be made available to 

20 a location entity for performing location estimates of the mobile station. 

However, the measurements of delay between a particular distributed antenna and the mobile station will include the 
aggregate delay components of several mechanisms, beyond the BS pilot PN offset delay. In the case of distributed antenna 
configurations, the simple TOA or TDOA model which is based solely of the speed of light, must now be adjusted to account for the 
purposefully introduced delay. 

25 The mobile station measures the arrival time T, for each pilot /reported to the BS. The pilot arrival time is the time of 

occurrence, as measured at the mobile station antenna connection, of the earliest arriving usable multipath of the pilot. The arrival 
time is measured relative to the mobile station' time reference in units of PN chips. The mobile station computes the reported pilot 
PN phase fj as: 

f. = (T ; + 64 x PILOT JN) mod2 ls , 
30 where PILOT_PN is the PN sequence offset of the pilot. 

Reference Fig. 6, which illustrates a typical distributed antenna configuration consisting of a repeater/amplifier and 
four distributed antennas. The total system delay, T, is: 

Ts = Tcfc + T 0 + T R + T, + T ? + T 3 + T< 
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During the installation phase of the high gain antenna (if required), repeater (if required) and the distributed 
antennas, if the system delay is measured at each distributed antenna and the values stored in a location database, including each 
antenna identification, and exact physical location (in three dimensions), then during a location request, all fixed delays will be 
known, thus the TP value can be determined by subtracting the fixed, known delay values from Ti, the measured time of arrival. 
S The TP value can now be used to determine a TOA and or a TDOA value in a manner similar to the non-distributed antenna case, 
thus location can be determined based on these TOA/TDOA ranging values. 

The required installation methods and procedures required to support wireless location are illustrated in Fig. 8: 
Methods and Procedures for DA Installation. By following these methods, the Location Center (LC) will contain a database 
populated with the necessary data values to perform accurate location estimates within the building containing the distributed 
10 antennas. Fig. DA-IO: Exemplary DA Location Database, illustrates typically data element types and values required in the DA 
location estimate model database. Fig. DA- 1 1 illustrates how a simple TOA location estimate model can be used to determine 
wireless location in a DA environment. Based on the known geometry and coverage areas of each DA cell, and the percentage of 
maximum radius, determined by the above classification, it is possible to construct radius-radius circles of the DA cells. The 
intersection of the three circles (in this case) provides the location estimate. 
15 In order for the TOA and TDOA location calculations to be determined, it is a necessary condition that during 

distributed antenna installation, the minimum values of the Delay Elements be set to each exceed the maximum practical (i.e., 
within the coverage area) TP values be at least 1/2 of a PN chip duration (about 500 nanoseconds), to easily allow for the CDMA 
Data Receivers to be able to correlate between the delay element values and the TP delay values. Fig. 12: DA Delay Spread Ranges, 
illustrates typical maximum ranging variable delay values (e.g., up to 1,960 feet) if 500 nanosecond guard zones (t) are used. If 
20 larger ranging values are required, then guard zone delays must be increased proportionally. 

Fig. 13: DA Cell Layout and Geometry, illustrates, for DA omniceli sizes with a radius of about 2,000 feet and guard 
zones of 500 nanoseconds, that the minimum required cumulative delay values for the delay elements are: t2 = 2.46 
microseconds, t 3 = 4.92 mS, and t 4 = 738 mS, respectively. 

It should also be noted that a maximum upper bound exists for the maximum amount of cumulative system 
25 propagation delay which can be tolerated by the CDMA mobile station. The total delay cannot exceed an amount that would 

interfere with the next pilot PN offset, or substantially delay the scanning time of the search receiver in the mobile station. In any 
case, 30 to 40 microseconds of total delay is acceptable, and would allow for a relatively large number of distributed antenna 
components to be included, thus no unusual impacts are required of the system to accommodate location methods. 

By purposefully introducing a relatively large amount of delay in the distributed antenna delay elements, relative to the 
30 maximum permissible TP delay values, it is possible to utilize the large Delay Element values to uniquely identify the distributed 
antenna ID, and thus via the distributed antenna database, to determine the antennas' exact location. Knowing the antenna's 
location and TP value (last stage of propagation delay), TOA and TDOA ranging can be achieved, and thus mobile station location 
within a distributed antenna configuration, can be determined. 
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Fig. 14: Actual Measurements and Classification, illustrates how COMA delay spread measurements are used in a DA 
configuration to form a relationship with the mobile station location with respect to the DA locations. Although the CDMA air 
interface standard only requires the signal strength and time of arrival of the first useable delay spread signal to be reported from 
the mobile station to the BS, assume here that the mobile station has the capability to provide the BS, and consequently the LC, 
S with a list of all peak values of CDMA fingers. 

Assume that the mobile station detects and telemeters three CDMA finger RF measurements, as shown in the table below, 
New Message Type Data Structure Content 



Signal Strength 


Delay Time of Arrival 


-77dBm 


1.68 microseconds 


-66 


3.98 


-95 


9.16 



Table: New Message Type Data Structure Content. 



Note that the measurements may be averaged over a sample space of 128 individual measurements. Referring now back 
10 to Fig. 14, it can be seen that the first finger is associated with the DA cell-l, range 0 to 1.96 microseconds, and DA cell-2, range 
2.46 microseconds to 4.42 uS, and DA cell-4, range 738 to 934 uS. Since the DA cell antennas are fixed, with known locations, 
correlation's can be derived and established to relate actual measurements with locations. Any one of several location estimate 
modules may be used, as shown in Fig. DA-12: Location Estimate using the radius-radius method, or multiple invocations of 
different modules may alternatively be used to form a location estimate of the mobile station within the DA environment. 
IS It is now possible to classify the above actual measurements as propagation delayed signals for the DA cells 1,2, and 4, 

since each DA cell delay range is know, and sufficient guard zones exist between delay spread ranges to unambiguously classify the 
measurements, and thus to determine mobile station location. The following table illustrates a typical database containing the 
classification columns for each DA ceil and their corresponding location in an x,y plane. 



DA Ceil ID 


Location (X, Y) in 


DA Cell Radius 


Low Range ( 


High Range (In 




feet) 




microseconds) 


microseconds) 


1 


(0.0) 


1.96 


0 


1.96 


2 


(-20,3000) 


1.96 


2.46 


4.42 


3 


(4000,2800) 


1.96 


4.92 


6.88 


4 


(1600,2800) 


1.96 


7.38 


934 



20 Table: New Message Type Data Structure Content 

Translating the actual delay measurements into a percentage of the maximum radius of each cell (i.e., cell I radius 
actual is 88 %, cell 2 radius actual is 78 %, and cell radius 4 actual is 91%) provides wireless location using familiar radius-radius 
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calculations. 

Depending upon the combinations of embodiments, the Location Center and Gateway may contain from one to three 
interfaces into the digital PCS network, shown as interfaces X, Y, and Z, in Fig. 24, Location and CTIA/TR45 Network Reference 
Model. Network interface reference points Urn, A, Ai, B, C, D and H are part of the Cellular Telecommunications Industry of America 

5 (CTIA)/Technical Reference 45 standards, and are not discussed further. 

Network interface reference point X provides a direct connection to the mobile switch center, used for transferring RF 
measurement signals from the mobile station and BS to the LC and for transferring location control between the LS and mobile 
station, and between the LC and BS. This interface can be implemented via any number of data communications circuit 
configurations and protocols in current use, such as a T-carrier data circuit, with DSU/CSUs at each end, using an intranet/internet 

10 protocol suite, such as TCP/IP, RPC messaging, or other middleware solutions, such as Pipes, IBM MQ series, world wide web 

protocols, such as jAVAA'RML scripts, hypertext markup ianguage (HTML) links, and may aiso include various firewaii schemes and 
data encryption mechanisms, etc, in order to communicate asynchronous messaging among the endpoints, and in particular, in 
reference to the final distribution of the location information to the desired end user. 

Network interface reference point Y is used in the embodiment wherein a public switched telephone network interface is 

15 required or desired. This interface is a straightforward method to support location applications wherein, for example, a mobile 
station user dials a telephone number in order to initiate a location request, and could also be used to telemeter RF measurement 
and location control messages between the LC and the mobile station/BS. Alternatively a timer-initiated process internal to the LC 
may be used to start a location request, or via any number of events external to the network. Point Y also has the advantage of not 
requiring a direct connection to a commercial radio mobile service providers' network elements, thus affording a convenient 

20 interface for use by third party location service providers unrelated to the commercial radio mobile service provider. 



NATIONAL SCALE WIRELESS LOCATION 

By utilizing specific data items used in the Home Location Register in the Advanced Intelligent Network, it is possible to 
determine the mobile station location on a national scale, i.e., location within the context of a state, and in which city. 

Network interface reference point Z is used in the embodiment wherein a gross location must be determined. A gross 
25 location is defined as an area associated with a particular mobile switch center coverage area. Mobile switch center coverage areas 
are typically bounded by a large metropolitan area, such as a city. The Home Location Register (HLR) contains gross location 
information. The Z interface allows the LC to query the home location register to determine if the user is in their "home area, or 
whether the user is roaming to another mobile switch center coverage area, such as another city. IS-41 Cellular Radio 
Telecommunications intersystem operations communications protocols provide mechanisms that allow a user to roam into 
30 authorized areas outside of their "home" area. 

If the user is roaming in another area, then the LC can use that information to initiate location control messages toward 
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the CDMA network currently hosting the mobile station user. Fig. 25 illustrates how a user based in Los Angeles, CA, for example, 
may roam to a CDMA system New York City, and be "located" within that metropolitan area, through a data communications 
network and a national Location Center Clearinghouse system. 



5 SIGNAL PROCESSOR SUBSYSTEM 

The signal processing subsystem receives control messages and signal measurements and transmits appropriate control 
messages to the wireless network via the location applications programming interface referenced earlier, for wireless location 
purposes. The signal processing subsystem additionally provides various signal idintification, conditioning and pre-processing 
functions, including buffering, signal type classification, signal filtering, message control and routing functions to the location 
10 estimate modules. 

There can be several combinations of Delay Spread/Signal Strength sets of measurements made available to the signal 
processing subsystem 20 within the Location CenterAystem 42, shown in Fig. 3. In some cases the mobile station 140 may be able 
to detect up to three or four Pilot Channels representing three to four Base Stations, or as few as one Pilot Channel, depending upon 
the environment. Similarly, possibly more than one BS 122 can detect a mobile station 140 transmitter signal, as evidenced by the 
1 5 provision of cell diversity or soft hand-off in the CDMA standards, and the fart that multiple CMRS' base station equipment 
commonly will overlap coverage areas. For each mobile station 140 or BS 122 transmitted signal detected by a receiver group at a 
station, multiple delayed signals, or "fingers" may be detected and tracked resulting from multipath radio propagation conditions, 
from a given transmitter. 

In typical spread spectrum diversity CDMA receiver design, the "first" finger represents the most direct, or least delayed 
20 multipath signal. Second or possibly third or fourth fingers may also be detected and tracked, assuming the mobile station contains 
a sufficient number of data receivers. Although traditional TOA and TDOA methods would discard subsequent fingers related to the 
same transmitted finger, collection and use of these additional values can prove useful to reduce location ambiguity, and are thus 
collected by the Signal Processing subsystem in the Location Center 142. 

For each pilot channel detection case, multiple fingers (up to three or four) may be detected and thus reported to the 
25 Location system, as shown in Fig. 22 and 23, for dense urban and rural settings, respectively. From the mobile receiver's 

perspective, a number of combinations of measurements could be made available to the Location Center. Table SP-I illustrates the 
available combinations for three and four receiver cases, respectively. 
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Table SP-i: Nominal CDMA Location Measurement Combinations 



The above Table SP-I scenario assumes that the mobile station design and data collection structure only permits a 1:1 
correspondence to exist between the number of base stations detected and the number of data receivers reporting multipath CDMA 
5 fingers. 

Table SP-I illustrates the potential combinations of detected CDMA signals representing multipath fingers and total 
number of detectable base station pilot signals in a given location within the radio coverage area 120. Due to the disperse and 
near-random nature of CDMA radio signals and propagation characteristics, traditional T0A/TD0A location methods have failed in 
the past, because the number of signals received in different locations area different. In a particularly small urban area, say less 

10 than 500 square feet, the number of RF signals and there multipath components may vary by over 100 percent. 

The following diagrams illustrate a certain case from a location measurement perspective, of signals received for a three 
-data receiver and a four-data receiver configuration, in a nominal three sector honeycomb base station configuration. In Fig. 1 8, a 
mobile station at location *T detects base stations lb, Sc, and 4a. However although a triad of signals are received, if varying 
multipath signals are received from one or more base stations, then ambiguity can still result Fig. 19 illustrates a mobile station 

15 located at position "A", detecting base stations lb, 5c, 4a, and 2c. Although additional information is made available in this second 
case, traditional hyperbolic combinations taken three at a time, yield multiple location estimates. In certain cases the limit of the 
back-side of a u far-away"sectored antenna can be used to determine the limit of RF coverage in another base station sector area. 
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Fig. 20 shows that normally a delay spread in sector I b would imply a range of a 120 degree solid angle. However by using the 
known fact that base station sector 2a contains a coverage limit, such negative logic can be used to further restrict the apparant 
coverage area in sector lb, from 120 degrees to approximately 90 degrees as shown in the illustration, in order to locate the mobile 
station B. Such information regarding sector 2a can be determined by collecting the remaining set information from mobile station 
5 B. 

Now consider more practical, less ideal cases. Due to the large capital outlay costs associated with providing three or 
more overlapping base station coverage signals in every possible location, most practical digital PCS deployments result in fewer 
than three base station pilot channels being reportable in the majority of location areas, thus resulting in a larger, more amorphous 
location estimate. Fig. 20 and 21 illustrate a typical relative error space wherein a mobile station detects only two base station pilot 
10 channels, and only one pilot channel, respectively. This consequence requires a family of location estimate location modules, each 
firing whenever suitable data has been presented to a modei, thus providing a location estimate to a backend subsystem which 
resolves ambiguities. 

Base Station Cell site planning tools which utilize antenna gain radiation patterns, environmental clutter, such as 
15 buildings, dense forests, terrain heights, etc., can provide reasonable training data to bootstrap the initial operation of the LC. 

An example of the types of data typically collected during field tests/runs is shown in the following database table SP-2 

below: 



Column 
Position 


Mobile Data Test Set: Data Type Logged 


1 


CDMA Time (absolute, from GPS) 


2 


Vehicle Speed (in mph) 


3 


Vehicle Latitude (in deg. North) 


4 


Vehicle Longitude (in deg. East) 


5 


GPS Source (binary, e.g., GPS or Dead Reckoning) 


6 


GPS Data available indicator (binary states) 


7 


First BS-Mobile Received Power (in dBm, 1 second averages) 


8 


Mobile transmit Gain Adjust (in dBm, 1 second average) 


9 


First BS Mobile Rx Pilot lj\ 0 (dB, 1 second average) 


10 


First BS Mobile received Frame Counts (integers per measurement period) 


II 


Mobile Finger's Average Time Separation (in nano/microseconds) 


12 


Mobile Fingers' Maximum Time Separation (in nano/microseconds) 


13 


Mobile Fingers' Number of Pilots locked (per 1 second average) 
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Column 
Position 


Mobile Data Test Set: Data Type Logged 


14 


Mobile finger Lock Counts 


(5 


First BS Received Frame Counts 


16 


First BS Eb/No set Point (in dB, 1 second average) 


17 


First BS ceil Rx Eb/No per antenna (in dB, i second average) 


18 


Hand-off State (relative to the First, or connected -to BS) 


19 


First BS Traffic Channel Gain 


20 


First BS Power Control Subchannel Gain 


21 


First BS Reverse Link full Frame Error Rate, over S00 frames 




Forward Link full Frame Error Rate, over 500 f fames 


23 


first BS Pilot Channel Delay Spread (in nanoseconds) 


24 


Second BS-Ranked Pilot Delay Spread (in nanoseconds) 


25 


Second BS-Ranked Pilot Relative Signal Strength (in dB) 


26 


Third BS-Ranked Pilot Delay Spread 


27 


Third BS-Ranked Pilot Relative Signal Strength (in dB) 


28 


Mobile Antenna Identification (in the case of a multi-sectored antenna) 


29 


Vehicle compass orientation (bearing or heading) 


30 


Mobile Station Power Class (an integer, 0-7, indicating max. power capabilities of the mobile station 
transmitter) 



Table SP-2: Typical CDMA Field Test Measurements 

Although the forward link mobile station's received relative signal strength (RRSS BS ) of detected nearby base station 
5 transmitter signals can be used directly by the location estimate modules, the base station's reverse link received relative signal 
strength (RRSS MS ) of the detected mobile station transmitter signal must be modified prior to location estimate model use, since the 
mobile station transmitter power level changes nearly continuously, and would thus render relative signal strength useless for 
location purposes. 

One adjustment variable and one factor value are required by the signal processing subsystem: I.) instantaneous 
10 relative power level in dBm (IRPL) of the mobile station transmitter, and 2.) the mobile station Power Class. By adding the IRPL to 
the RRSS m> a synthetic relative signal strength (SRSS m ) of the mobile station 140 signal detected at the BS 122 is derived, which 
can be used by location estimate model analysis, as shown below: 
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SRSShs = RRSS MS + IRPL (indBm) 

SRSS mi a corrected indication of the effective path loss in the reverse direction (mobile station to BS) t is now comparable 
with RRSS K and can be used to provide a correlation with either distance or shadow fading because it now accounts for the change 

5 of the mobile station transmitter's power level. The two signals RRSS K and SRSS m can now be processed in a variety of ways to 
achieve a more robust correlation with distance or shadow fading. 

Although Rayleigh fading appears as a generally random noise generator, essentially destroying the correlation value of 
either RRSS BS or SRSS m measurements with distance individually, several mathematical operations or signal processing functions 
can be performed on each measurement to derive a more robust relative signal strength value, overcoming the adverse Rayleigh 

1 0 fading effects. Examples include averaging, taking the strongest value and weighting the strongest value with a greater coefficient 
than the weaker value, then averaging the results. This signal processing technique takes advantage of the fart thai although a 
Rayleigh fade may often exist in either the forward or reverse path, it is much less probable that a Rayleigh fade also exists in the 
reverse or forward path, respectively. A shadow fade however, similiarly affects the signal strength in both paths. 

At this point a COMA radio signal direction-independent "net relative signal strength measurement" is derived which is 

15 used to establish a correlation with either distance or shadow fading, or both. Although the ambiguity of either shadow fading or 
distance cannot be determined, other means can be used in conjunction, such as the fingers of the CDMA delay spread 
measurement, and any other TOA/IDOA calculations from other geographical points. In the case of a mobile station with a certain 
amount of shadow fading between its BS 122 (Fig. 2), the first finger of a CDMA delay spread signal is most likely to be a relatively 
shorter duration than the case where the mobile station 140 and BS 122 are separated by a greater distance, since shadow fading 

20 does not materially affect the arrival time delay of the radio signal. 

By performing a small modification in the control electronics of the CDMA base station and mobile station receiver 
circuitry, it is possible to provide the signal processing subsystem 20 (reference Fig. I) within the Location system 42 (Fig. I) with 
data that exceed the one-to-one CDMA delay-spread fingers to data receiver correspondence. Such additional information, in the 
form of additional CDMA fingers (additional multipath) and all associated detectable pilot channels, provides new information 

25 which is used to enhance to accuracy of the Location Center's location estimate location estimate modules. 

This enhanced capability is provided via a control message, sent from the Location system 42 to the mobile switch 
center 12, and then to the base station(s) 122 (Fig. 2) in communication with, or in close proximity with, mobile stations 140 to be 
located. Two types of location measurement request control messages are needed: one to instruct a target mobile station 140 (i.e., 
the mobile station to be located) to telemeter its BS pilot channel measurements back to the primary BS 122 and from there to the 

30 mobile switch center 1 12 and then to the location system 42. The second control message is sent from the location system 42 to the 
mobile switch center 1 12, then to first the primary BS 122, instructing the primary BS* searcher receiver to output (i.e., return to 
the initiating request message source) the detected target mobile station 140 transmitter CDMA pilot channel offset signal and their 
corresponding delay spread finger (peak) values and related relative signal strengths. 
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The control messages are implemented in standard mobile station 140 and BS 122 CDMA receivers such that all data 
results from the search receiver and multiplexed results from the associated data receivers are available for transmission back to 
the Location Center 142. Appropriate value ranges are required regarding mobile station 140 parameters T_ADD l( T_DROP s , and 
the ranges and values for the Active, Neighboring and Remaining Pilot sets registers, held within the mobile station 140 memory. 
Further mobile station 140 receiver details have been discussed above. 

In the normal case without any specific multiplexing means to provide location measurements, exactly how many CDMA 
pilot channels and delay spread fingers can or should be measured vary according to the number of data receivers contained in 
each mobile station 140. 

As a guide, it is preferred that whenever RF characteristics permit, at least three pilot channels and the strongest first 
three fingers, are collected and processed. 

From the BS 122 perspective, it is preferred that the strongest first four CDMA delay spread fingers and the mobile 
station power level be collected and sent to the location system 42, for each of preferably three BSs 1 22 which can detect the mobile 
station 140. 

Table SP-3 illustrates the resulting extended combinations of BS signals (pilot channels) and finger measurements 
potentially available, based on the above preferred conditions. The philosophy is to collect as much reasonable data as is practical, 
given the constraints of CDMA receivers, search times, receiver memory storage and available CPU and data transmission 
bandwidth, in order that sufficient orthogonal information can be processed to minimize location estimate error. 
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Table SP-3: Extended CDMA Location Measurement Combinations 

As can be seen from the table, a much larger combination of measurements is potentially feasible using the extended 
S data collection capability of the CDMA receivers. In the case of the last row shown, additional combinations are also possible using a 
similar scheme of allocating the number of CDMA fingers detected at the first or strongest BS, followed by the second strongest base 
station, then the third strongest base station, etc. 

Fig. 29 illustrates the components of the Signal Processing Subsystem 20. The main components consist of the input 
queue(s) 7, signal classifier/fitter 9, digital signaling processor 17, imaging filters 19, output queue(s) 21, router/distributor 23, a 

10 signal processor database 26 and a signal processing controller 15. 

Input queues 7 are required in order to stage the rapid acceptance of a significant amount of RF signal measurement 
data, used for either location estimate purposes or to accept autonomous location data. Each location request using fixed base 
stations may, in one embodiment, contain from I to 128 radio frequency measurements from the mobile station, which translates 
to approximately 61.44 kilobytes of signal measurement data to be collected within 10 seconds and 128 measurements from each of 

IS possibly four base stations, or 245.76 kilobytes for all base stations, for a total of approximately 640 signal measurements from the 
five sources, or 307 J kilobytes to arrive per mobile station location request in 1 0 seconds. An input queue storage space is assigned 
at the moment a location request begins, in order to establish a formatted data structure in persistent store. Depending upon the 
urgency of the time required to render a location estimate, fewer or more signal measurement samples can be taken and stored in 
the input queue(s) 7 accordingly. 

20 The signal processing subsystem 20 supports a variety of wireless network signaling measurement capabilities by 

detecting the capabilities of the mobile and base station through messaging structures provided bt the location application 
programming interface 14 in fig. I. Detection is accomplished in the signal classifier 9 (Fig. 29) by referencing a mobile station 
database table within the signal processor database 26, which provides, given a mobile station identification number, mobile 
station revision code, other mobile station charactersitics. Similiarly, a mobile switch center table 31 provides MSC characteristics 
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and identifications to the signal classifier/filter 9. The signal classifier/filter adds additional message header information that 
further classifies the measurement data which allows the digital signal processor and image filter components to select the proper 
internal processing subcomponents to perform operations on the signal measurement data, for use by the location estimate 
modules. 



detemines via a signal processing database 26 query that the message is to be associated with a home base station module. Thus 

appropriate header information is added to the message, thus enabling the message to pass through the digital signal processor 17 

unaffected to the output queu 21, and then to the router/distributor 23. The router/distributor 23 then routes the message to the 

HBS module 6 shown in Fig. I. Those skilled in the art will understand that associating location requests from Home Base Station 
10 configurations require substantially less data: the mobile identification number and the associated wireline telephone number 

transmission from the home location register are on the order of less than 32 bytes. Consequentially the home base station message 

type could be routed without any digital signal processing. 

Output queue(s) 21 are required for similar reasons as input queues 7: relatively large amounts of data must be held in a 

specific format for further location processing by the location estimate modules. 
15 The router and distributor component 23 is responsible to directing specific signal measurement data types and 

structures to their appropriate modules. For example, the HBS module has no use for digital filtering structures, whereas the TDOA 

module would not be able to process an HBS response message. 

The controller 15 is responsible for staging the movement of data among the signal processing subsystem 20 components 

input queue 7, digital signal processor 17, router/distributor 23 and the output queue 21 , and to initiate signal measurments within 
20 the wireless network, in response from an internet 68 location request message in Fig. I, via the location application programming 

interface 14. 

In addition the controller 15 receives autonomous messages from the MSC , via the location applications programming 
interface 14 (Fig. I) or L-API and the input queue 7, whenever a 9-1-1 wireless call is originated. The mobile switch center provides 
this autonomous notification to the location system as follows: By specifying the appropriate mobile switch center operations and 

25 maintenance commands to surveil calls based on certain digits dialed such as 9- U , the location applications programming 

interface 14 (Fig. I), in communications with the MSC 12a and 12b in Fig J, receives an autonomous notification whenever a mobile 
station user dials 9-1-1. Specifically, a bi-directional authorized communications port is configured, usually at the operations and 
maintenance subsystem of the MSC 12a and 12b in Fig. I , or with their associated network element manager system(s), with a data 
circuit, such as a DS-I, with the location applications programming interface 14 in Fig. I. Next, the "call trace" capability of the 

30 mobile switch center is activated for the respective communications port. The exact implementation of the vendor- specific man- 
machine or Open Systems Interface (OSI) commands(s) and their associated data structures generally vary among MSC vendors, 
however the trace function is generally available in various forms, and is required in order to comply with Federal Bureau of 



5 



Regarding service control point messages autonomously received from the input queue 7, the signal classifier/filter 9 



SUBSTITUTE SHEET (RULE 26) 



WO 98/10538 




PCT/US97/15933 



Investigation authorities for wire tap purposes. After the appropriate surveillance commands are established on the MSC, such 9-1-1 
call notifications messages containing the mobile station identification number (MIN) and, in phase I E9-I-I implementations, a 
pseudo-automatic number identication (a.ta. pANI) which provides an association with the primary base station in which the 9-1- 
I caller is in communicaiton. In cases where the pANI is known from the onset, the signal processing subsystem avoids querying the 
5 HSC in question to determine the primary base station identification associated with the 9-1-1 mobile station caller. 

After the signal processing controller IS receives the first message type, the autonomous notification message from the 
mobile switch center 1 12 to the location system 42, containing the mobile identification number and optionally the primary base 
station identification, the controller 15 queries the base station table 13 in the signal processor database 26 to determine the status 
and availability of any neighboring base stations, including those base stations of other CMRS in the area. The definition of 

!0 neighboring base stations include not only those within a n rovisionah!e "ho n " based on the cell design reuse factor but also 
includes, in the case of CDMA, results from remaining set information autonomously queried to mobile stations, with results stored 
in the base station table. Remaining set information indicates that mobile stations can detect other base station (sector) pilot 
channels which may exceed the "hop" distance, yet are nevertheless candidate base stations (or sectors) for wireless location 
purposes. Although cellular and digital cell design may vary, "hop" distance is usually one or two cell coverage areas away from the 

I S primary base station's cell coverage area. 

Having determined a likely set of base stations which may both detect the mobile station's transmitter signal, as well as 
to determine the set of likely pilot channels (i.e., base stations and their associated physical antenna sectors) detectable by the 
mobile station in the area surrounding the primary base station (sector), the controller 15 initiates messages to both the mobile 
station and appropriate base stations (sectors) to perform signal measurements and to return the results of such measurements to 

20 the signal processing system regarding the mobile station to be located. This step may be accomplished via several interface means. 
In a first case the controller 15 utilizes, for a given MSC, predetermined storage information in the MSC table 3 1 to determine which 
type of commands, such as man-machine or OSI commands are needed to request such signal measurements for a given MSC 12a 
or 12b in Fig. I. The controller generates the mobile and base station signal measurement commands appropriate for the NSC and 
passes the commands via the input queue 7 and the locations application programming interface 14 in Fig.l , to the appropriate MSC 

25 12a and 12b, using the authorized communications port mentioned earlier. In a second case the controller 15 communicates directly 
with base stations as discussed above and shown in Fig. 5, Location Center-base station access, multiple CMRS, in this second case 
an alternative embodiment is provided to directly extract the wireless location signal measurement data from each base station 
associated with each of multiple CMRS networks within having to interface directly with the MSC for signal measurement extraction. 

Upon receipt of the signal measurements, the signal classifier 9 examines location application programming interface- 
30 provided message header information from the source of the location measurement (for example, from a fixed BS 122, a mobile 
station 140, a distributed antenna system 168 or message location data related to a home base station), provided by the location 
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applications programming interface (L-API) via the input queue 7 and determines whether or not device filters 17 or image filters 
19 are needed, and assesses a relative priority in processing, such as an emergency versus a background location task, in terms of 
grouping like data associated with a given location request In the case where multiple signal measurement requests are 
outstanding for various base stations, some of which may be associated with a different CMRS network, and additional signal 

5 classifier function includes sorting and associating the appropriate incoming signal measurements together such that the digital 
signal processor 17 processes related measurements in order to build ensemble data sets. Such ensembles allow for a variety of 
functions such as averaging, outlier removal over a timeperiod, and related filtering f unctions, and further prevent association 
errors from occuring in location estimate processing. 

Another function of the signal classifier/low pass filter component 9 is to filter information that is not useable, or 

10 information that could introduce noise or the effect of noise in the location estimate modules. Consequently low pass matching 
filters are used to match the in-common signal processing components to the characteristics of the incoming signals. Low pass 
filters match: Mobile Station, base station, CMRS and MSC characteristics, as wall as to classify Home Base Station messages. 

The signal processing subsystem 20 in Fig. I contains a base station database table 13 (Fig. 29) which captures the 
maximum number of CDMA delay spread fingers for a given base station, containing information structures as shown in table SP-4 

15 below: 



Primary Base 

Station 

Identification 


Latitude, 

Longitude, 

elevation 


Pilot Channel 
Offset 


BS 

Identifier 
code 


Maximum No. of 
CDMA Fingers 


DEN-OOI 


x.y.z 


5 


CODENABC00I 


4 


DEN-002 


p.q.f 


25 


CODENABC002 


4 


DEN-003 


s,t,u 


20 


CODENABC003 


3 


DEN-004 


a,b,c 


IS 


CODENABC004 


4 


BLD-OOS 


<Uf 


45 


COBLDABC005 


4 













Table SP-4: Base Station Characteristics 



The base station identification code, or CLLI or common language level identification code is useful in identifying or 
20 relating a human-labeled name descriptor to the Base Station. Latitude, Longitude and elevation values are used by other 
subsystems in the location system for calibration and estimation purposes. As base stations and/or receiver characteristics are 
added, deleted, or changed with respect to the network used for location purposes, this database table must be modified to reflect 
the current network configuration. 

Just as an upgraded base station may detect additional CDMA delay spread signals, newer or modified mobile stations 
25 may detect additional pilot channels or CDMA delay spread fingers. Additionally different makes and models of mobile stations may 
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acquire improved receiver sensitivities, suggesting a greater coverage capability. The table below establishes the relationships 
among various mobile station equipment suppliers and certain technical data relevant to this location invention. 

Although not strictly necessary, The MIN can be populated in this table from the PCS Service Provider's Customer Care 
system during subscriber activation and fulfillment, and could be changed at deactivation, or anytime the end-user changes mobile 
stations. Alternatively, since the MIN, manufacturer, model number, and software revision level information is available during a 
telephone call, this information could extracted during the call, and the remaining fields populated dynamically, based on 
manufacturer's' specifications information previously stored in the signal processing subsystem 20. Default values are used in cases 
where the NIN is not found, or where certain information must be estimated. 



Mobile Station 

■ d C !■ ti •! C 2 *i OS? 

(MIN) 


Manufact- 
urer 


Model 
No. 


Allowed 
S/w 

Revision 
Levels 


Maximum 
No. of 
CDMA 
Fingers 


Maxim 

um tin 


Transmit 
Power 
Class 
(Max) 


Rec. 

Thprmsal 


of 

Pilots 

Detecta 

ble 


Noise 
Floor 
(dBm) 


3034561234567 


Sony 


5 


Rl.0 


3 


3 


2 


-114 


3034561234568 


Qualcomm 


25 


R2.0I 


4 


4 


4 


-115 


3034561234569 


Panasonic 


20 


RI.I 


3 


3 


5 


-113 


3034561234570 


fujutshu 


15 


R2i 


4 


4 


0 


-116 


3034561234571 


Sony 


45 


RI.I 


3 


3 


7 


-115 


Default 


Default 


Default 


Rl.0 


3 


3 


3 


-112 
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Table SP-5: Mobile Station Characteristics Table 



A low pass mobile station filter, contained within the signal classifier/low pass filter 9 of the signal processing 
subsystem 20, uses the above table data to perform the following functions: I) act as a low pass filter to adjust the nominal 
assumptions related to the maximum number of CDMA fingers, pilots detectable; and 2) to determine the transmit power class and 
1 5 the receiver thermal noise floor. Given the detected reverse path signal strength, the required value of SRSS m a corrected 

indication of the effective path loss in the reverse direction (mobile station to BS) t can be calculated based on the SP-S table data 
contained within the mobile station table 1 1, in the signal processing database 26. 

The effects of the maximum Number of CDMA fingers allowed and the maximum number of pilot channels allowed 
essentially form a low pass filter effect, wherein the least common denominator of characteristics are used to filter the incoming RF 
20 signal measurements such that a one for one matching occurs. The effect of the Transmit Power Class and Receiver Thermal Noise 
floor values is to normalize the characteristics of the incoming RF signals with respect to those RF signals used. 

Fig. 4, Location Provisioning from Multiple CMRSs, illustrates a system architecture to enable the customer care systems 
belonging to different CMRSs, either on an autonomous or periodic basis, to update a provisionable signal processing database 26, 
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containing the mobile station characteristics, in communication with the signal classifier/filter 9, input queue 7, and the location 
applications programming interface for customercasre systems (L-API-CCS) 139. The signal classifier/filter 20 is in communication 
with both the input queue 7 and the signal processing database 26. In the early stage of a location request the signal processing 
subsystem 142 in Fig. 4, will receive the initiating location request from either an autonomous 9-1-1 notification message from a 

5 given MSC, or from a location application (for example, see Fig. 36), for which mobile station characteristics about the target 
mobile station 140 (Fig. 2) is required. Referring to Fig. 29, a query is made from the signal processing controller IS to the signal 
processing database 26, specifically the mobile station table 1 1, to determine if the mobile station characteristics associated with 
the MIN to be located is available in table II. if the data exists then there is no need for the controller IS to query the wireless 
network in order to determine the mobile station characteristics, thus avoiding additional real-time processing which would 

10 otherwise be required across the air interface, in order to determine the mobile station MIN characteristics. The resulting mobile 
station information my be provided either via the signal processing database 26 or alternatively a query may be performed directly 
from the signal processing subsystem 20 to the NSC in order to determine the mobile station characteristics. 



the mechanism to populate and update the mobile station table 1 1 within the database 26. The L-API-CCS 139 contains its own set 

15 of separate input and output queues or similar implementations and security controls to ensure that provisioning data is not sent 
to the incorrect CHRS. The interface 1 155a to the customer care system for CMRS-A 1 150a provides an autonomous or periodic 
notification and response application layer protocol type, consisting of add, delete, change and verify message functions in order to 
update the mobile station table 1 1 within the signal processing database 26, via the controller 15. A similar interface 1 155b is used 
to enable provisioning updates to be received from CMRS-B customer care system 1 150b. 

20 Although the L-API-CCS application message set may be any protocol type which supports the autonomous notification 

message with positive acknowledgment type, the Tl MLS group within the American National Standards Institute has defined a 
good starting point in which the L-API-CCS could be implemented, using the robust OSI TMN X-interface at the service management 
layer. The object model defined in Standards proposal number TIMI.5/96-22R9, Operations Administration, Maintenance, and 
Provisioning (OAM&P) - Model for Interface Across jurisdictional Boundaries to Support Electronic Access Service Ordering: Inquiry 

25 function, can be extended to support the L-API-CCS information elements as required and further discussed below. Other choices in 
which the L-API-CCS application message set may be implemented include ASCII, binary, or any encrypted message set encoding 
using the Internet protocols, such as TCP/IP, simple network management protocol, http, https, and email protocols. 

Referring to the digital signal processor (DSP) 17, in communication with the signal classifier/LP filter 9, the DSP 17 
provides a time series expansion method to convert non-HBS data from a format of an signal measure data ensemble of time-series 

30 based radio frequency data measurements, collected as discrete time-slice samples, to a three dimensional matrix location data 
value image representation. Other techniques further filter the resultant image in order to furnish a less noisy training and actual 
data sample to the location estimate modules. 



A location application programming interface, L-API-CCS 139 to the appropriate CMRS customer care system provides 



Referring now to digital signal and image filter processing, by way of example, a forward-path CDMA mobile station 
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delay spread RF measurement sample is illustrated in Fig. 22, for the mobile station reception of one sample of transmission signal 
related to BS-1, looted at 16th and Stout Streets. In this sample three fingers or groups of RF energy (relative signal strength is 
indicated along the vertical axis) were detected. A first CDMA finger was found at a delay of about 3.4 microseconds, and relative 
signal strength of about -80 dBm. A second finger was found at a delay of about 5 microseconds, and peak strength of about -55 
5 dBm, followed by a third finger at 6.5 microseconds and a strength of about -92 dBm. Two other base stations were detected, BS-5 
and BS-2, along with their respective three CDMA delay spread fingers. 

Refer now to the left image shown in Fig. 26: Delay Spread Profile Image. After 128 samples of data are collected of the 
delay spread-relative signal strength RF data measurement sample: mobile station RX for BS-I and grouped into a Quantization 
matrix, where rows constitute relative signal strength intervals and columns define delay intervals. As each measurement row, 
10 column pair (which could be represented as a complex number or Cartesian point pair) is added to their respective values to 
generate a Z direction of frequency of recurring measurement value pairs or a density recurrence function. By next applying a grid 
function to each x, y, and z value, a three-dimensional surface grid is generated, which represents a location data value or unique 
print of that 128-sample measurement. Fig. 28 illustrates the result of image generation when a number of data samples, or an 
ensemble of signal strength, delay paris of values are added within a given bin area or matrix, to thus create a type of three- 
15 dimensional image, representing a particular RF signaling behavior at a given location. 

Refer now to the right image shown in Fig. 26. In the general case where a mobile station is located in an environment 
with varied clutter patterns, such as terrain undulations, unique man-made structure geometries (thus creating varied multipath 
signal behaviors), such as a city or suburb, although the first CDMA delay spread finger may be the same value for a fixed distance 
between the mobile station and BS antennas, as the mobile station moves across such an arc, different finger-data are measured. In 
20 the right image for the defined BS antenna sector, location classes, or squares numbered one through seven, are shown across a 
particular range of line of position (LOP). 

A traditional TOA/TDOA ranging method between a given BS and mobile station only provides a range along the arc, 
thus introducing ambiguity error. However a unique three dimensional image can be used in this method to specifically identify, 
with recurring probability, a particular unique location class along the same Line Of Position, as long as the multipath is unique by 
25 position but generally repeatable, thus establishing a method of not only ranging, but also of complete latitude, longitude location 
estimation in a Cartesian space. In other words, the unique shape of the "mountain image" enables a correspondence to a given 
unique location class along a line of position, thereby eliminating traditional ambiguity error. 

Although man-made external sources of interference, Rayleigh fades, adjacent and co-channel interference, and 
variable clutter, such as moving traffic introduce unpredictability (thus no "mountain image" would ever be exactly alike), three 
30 basic types of filtering methods can be used to reduce matching/comparison error from a training case to a location request case: 
I.) select only the strongest signals from the forward path (BS to mobile station) and reverse path (mobile station to BS), 2.) 
Convolute the forward path 128 sample image with the reverse path 128 sample image, and 3.) process all image samples through 
various digital image filters to discard noise components. 
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The strongest signal technique has been discussed previously in the data filter section. Fig. 27: Convolution of Forward 
and Reverse Images, illustrates one method that essentially nulls noise completely, even if strong and recurring, as long as that 
same noise characteristic does not occur in the opposite path. 

The third technique of processing CDMA delay spread profile images through various digital image filters, provides a 
5 resultant "image enhancement" in the sense of providing a more stable pattern recognition paradigm to the neural net location 
estimate model. For example, image histogram equalization can be used, as illustrated in Fig. 30 (before equalization) and 31 
(after equalization) to rearrange the images' intensity values, or density recurrence values, so that the image's cumulative 
histogram is approximately linear. 

Other methods which can be used to compensate for a concentrated histogram include: I) Input Cropping, 2) Output 
10 Cropping and 3) Gamma Correction. Equalization and input cropping can provide particularly striking benefits to a CDMA delay 
spread profile image. Figs 32 and 33 illustrate the three dimensional grid images of the before and after input cropping filter 
example. As shown in Fig. 33, input cropping removes a large percentage of random signal characteristics that are non-recurring. 

Other filters and/or filter combinations can be used to help distinguish between stationary and variable clutter 
affecting multipath signals. For example, it is desirable to reject multipath fingers associated with variable clutter, since over a 
15 period of a few minutes such fingers would not likely recur. Further filtering can be used to remove recurring (at least during the 
sample period), and possibly strong but narrow "pencils" of RF energy. A narrow pencil image component could be represented by 
a near perfect reflective surface, such as a nearby metal panel truck stopped at a traffic light. 

On the other hand, stationary clutter objects, such as concrete and glass building surfaces, adsorb some radiation 
before continuing with a reflected ray at some delay. Such stationary clutter-affected CDMA fingers are more likely to pass a 4X4 
20 neighbor Median filter as well as a 40 to 50 percent Input Crop filter, and are thus more suited to neural net pattern recognition. 
Fig. 33 illustrate five "pencils" of CDMA finger energy that passed a simple 50 percent Input Crop filter. However, as shown in Fig. 
34 when subjected to a 4X4 neighbor Median filter and 40 percent clipping, all five pencil-shaped fingers have been deleted. Fig. 35 
illustrates the further simplified result of a 50 percent cropping and 4X4 neighbor median filtering. Other filtering methods include 
custom linear filtering, adaptive (Weiner) filtering, and custom nonlinear filtering. 
25 The DSP 17 may provide data emsemble results, such as extracting the shortest time delay with a detectable relative 

signal strength, to the router/distributor 23, or alternatively results may be processed via one or more image filters 19, with 
subsequent transmission to the router/distributor 23. The router/distributor 23 examines the processed message data from the DSP 
17 and stores routing and distribution information in the message header. The router/distributor 23 then forwards the data 
messages to the output queue 21, for subsequent queuing then transmission to the appropriate location estimators DA module 10, 
30 TOA/IDOA module 8 or the HBS module 6, in Fig. I. 

HOME BASE STATION MODULE 

Upon receiving a message from the Data Capture Gateway or the signal processing subsystem 20, the HBS location 
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estimate model examines a Home Base Station Table which defines relationships among a wireless M IN, and wireline telephone 
number, characteristics of the HBSD, and the possibility to use various signal types in order to further define the location within the 
address area of the fixed location HBSD. The following table, populated by the commercial mobile radio service provider at HBSD 
installation time, is used by the HBS model to determine location whenever the mobile station 140 is located within communication 
5 range of the HBSD: 



Wireline 
MIN 


Wireless 
MIN 


HBSD Model 


HBSD location 

Latitude, 

Longitude 


Fixed HBSD Location 


CDMA 

Strength/Delay 
Measurements ? 


3035561234 


3035661299 


Sony Qx-9000, Rev. 1.1 


52.619488 N, 
112.4197601 W 


727 Magnolia Drive, Boulder, 
CO 


No 


3035561236 


3035661200 


Panasonic PF-130, Rev. 5.0 


52.645488 N, 
112.4197601 W 


1401 Digit Drive, Boulder, CO 


Yes 


3035561236 


3035661240 


Panasonic PF-130, Rev. 3.4 


52.779488 N, 
112.4197601 W 


1698 Folsom St., Boulder, CO. 


No 


3035561284 


3035661205 


Panasonic PF-180, Rev. 5.0 


5L6I948B N, 
111.9197601 W 


990 Nutcracker Dr., Niwot, CO. 


NO 


3035561224 


3035661266 


Panasonic Pf-5000, Rev.J.O 


52.61 955B N, 
112.4197601 W 


5606 Bismark Circle, Denver, 
CO 


Yes 














Ta 


ble HBS-I: HBSD Characteristics 



In the event RF signals are available for telemetry from the HBSD to the location system, such information may be 
10 solicited from the location system to the HBSD, in the form of a request/response message scheme, using for example, a data- 
under- voice technique* In such cases the SSP provides a data connection with the location system 42 via the PSTN. The home base 
station may interact with the mobile station in the same manner as a cordless telephone transceiver interacts with a cordless 
telephone, when the mobile station is within an acceptable range. 

The HBS module 6 in Fig. I outputs the Latitude and Longitude location estiamtes to either the PSTN 24 or to the 
15 Internet 68, dependending upon the source of the originating location request. 

DISTRIBUTED ANTENNA MODULE 

Upon receipt of one or more data ensemble messages from the signal processing subsystem 20 in Fig. I, the distributed 
antenna (DA) module 10 queries a previously populated distributed antenna database to determine the locations of distributed 
antennas associated with the measured DA antenna "pilot delays" so that the detected signal measurement delay signal values 
20 received from the mobile station receivers and base station receivers can be input to the TOA/IDOA module. The TOA/IDOA module 
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then utilizes the radius-radius method, or time difference method, in order to provide location estimates within the building or area 
containing the distributed antennas. 



5 estimates to be achieved in wireless location. An aspect in this invention includes daisey chaining communication circuits or 
transport facilities between or among base stations, in order to simplify the installation and operation of such base stations. Base 
stations normally communicate with the mobile switch center using T-carrier transport facilities, in order to carry voice and data 
bearer traffic, and to transport bi-directional control signals. However for various economic or other reasons it may not be 
justifiable to install such transport facilities. At the base station, by essentially originating a plurality of mobile telephone calls 

10 using the data communications option, and terminating such calls at the mobile switch center appropriately, the outputs of the 
base station transport multiplex circuits are re-directed into the data communication circuits normally intended for use by mobile 
stations in establishing a data circuit communication call to the network. Circuits at the mobile switch center used to terminate 
these data calls, redirect the communication to those circuits normally used to terminate the T-carrier facilities from the base 
stations. In this manner, existing wireless channels can be used to provide transport via this daisy-chaining method between certain 

15 base stations and the mobile switch center, thus simplifying connectivity in cases where the installation of transport facilities would 
either be impossible or impractical. 

DISTANCE FIRST ORDER MODULE (TOA/TDOA) 

Particular distinctions over the current state of the art include utilizing essentially the native electronics, antennas and 
standards, and opposed to overlay solutions, supervisor functions which control a hybrid set of techniques, including Time Of 

20 Arrival (TOA), Time Difference of Arrival (TDOA) in both the forward and reverse paths, pilot signal strengths, power control, 
mobile stations (mobile station) state conditions, stochastic features of environmental clutter, multipath detection and mitigation, 
and robustness, supporting a variety of conditions including degraded/faulty equipment, distributed and SMART antennas, various 
registration modes, and various call processing conditions such as soft, hard and idle hand-off conditions, location during the idle 
state, traffic-bearing states, and location during cases of severe multipath, such as that experienced in urban canyon environments, 

25 as well as location in suburban and rural cases. 

Since each base station is required to emit a constant signal-strength pilot pseudo-noise (PN) sequence on the forward 
link channel identified uniquely in a network system by a pilot sequence offset and frequency assignment, it is possible to use the 
pilot channels of active, candidate, neighboring and remaining sets of pilots, associated with neighboring base stations, stored in 
the mobile station, for TOA and TDOA measurements performed by the mobile station. 

30 Based on the arrival time measurement estimates and the speed of propagation, ranges or range differences between 

the base stations and the mobile station can be calculated. TOA and/or TDOA measurements can then be input to either the radius- 



DAISEY CHAINING BASE STATIONS 



As a practical matter it may be necessary in some network conditions to add base stations in areas to permit improved 
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radius multilateration or the time difference multilateration algorithms. 

By utilizing the known base station positions, location of the mobile station can be determined. Since measurements 
and base station positions can be sent either to the network or the mobile station, location can be determined in either entity. 

Since not all measurements can provide accurate location results at all times and conditions, a variety of supervisory 
S logic processes can be invoked to resolve or litigate the problem area. 

As those familiar with the ElA/f IA IS-9S and Tl PI/JTC CDMA standards specifications know, mobile station call 
processing consists of four states: 

1. Initialization State- where the mobile station selects and acquires a system, a network, and timing information. This state 
consists of four substates; System Determination, Pilot Channel Acquisition, Sync Channel Acquisition, and Timing Change 

10 Substate, 

2. Idle State- where the mobile station monitors messages on the Paging Channel, and supports procedures such as Message 
Acknowledgment, nine modes of Registration, Idle Hand-off, Pilot Search, and response to Overhead Information, such as 
System and Access Parameters (which include BS Latitude and Longitude), mobile station Message Transmission Operation 
(i.e., Data Burst) and Neighboring List messages; 

15 3. System Access State - where the mobile station sends messages to the base station on the Access Channel. This state consists of 
six substates: Update Overhead, Origination Attempt, Page Response, mobile station Order/Message Response, Registration 
Access; Message Transmission Operation/Data Burst); 
4. Mobile station Control on the Traffic Channel State - where the mobile station communicates with the primary base station 
using the forward and Reverse Traffic Channels. This state consists of five substates: TC initialization, Waiting for Order, 
20 Waiting for mobile station Answer, Conversation (which includes hand-off procedures and earliest arriving usable multipath 

components of pilots), and Release. 

At power-up an IS-95 or TIPI PCS CDMA compliant mobile station enters Initialization State, as described in IS-95, 
section 6.6.1. During the System Determination substate, the mobile station refers to its internal memory to acquire preferences for 
system carrier (A or B), or the preferred carrier at 1.8-2.0 GHz, and for other types of service, including advanced mobile phone 
25 service, or AMPS, as well as narrow band advanced mobile phone service, or NAMPS. 

A CDMA-preferred mobile station then transfers to the Pilot AcquisitionSubtiaie. The mobile station tunes to the CDMA 

Channel number equal to CDHACH S then sets its Walsh code (always WO) for the Pilot channel where it begins searching for pilot 

energy, in terms of energy per bit, per spectral density. 

Once a sufficiently strong (as defined by the T_ADD threshold parameter) pilot channel has been identified within 

30 T2Qrn secon( ki the mobile station enters the Sync Channel Acquisition Substate, where the mobile station receives a Sync channel 

Message ti\zt includes, among other information, system time and the unique PN offset index for that particular BS. In the Timing 
Change substate, the mobile station adjusts its internal timing to match the BS's CDMA system time. At the completion of the 
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Timing Change substate, the mobile station is completely synchronized to the CDMA system's BS time. 

After satisfactoty synchronization the mobile station then enters the stable Idle State, where the paging channel begins 
to be monitored. 

At this point at least two alternatives are possible: 
5 I. Perform Location determination without consumption of user-perceived air time via the introduction of a new call 
processing state, or 

2. Perform Location determination via the traffic channel (requires air time) 

In cases where Distributed Antennas (OAs), and/or Home Base Stations (HBS) are used, each location of these devices 
can be sent to the mobile station. There are at least three format-types possible in conveying this type of location information in 
10 the GeoLocation Message. First, A unique identifier can be assigned to each DA/HBS, such as a fully distinguished name. An example 
of location information could be: Within the USA f State of Colorado, city of Denver, with Service Provider xyz, BS ID 129, 
Distributed Antenna number 8. Or more compactly, the location string is structured as, "USA.CO.DEN.xyz.l29.DA8". Secondly, an 
easy-to- understand human style data message can be sent, such as, "You are near the 30th floor of the Sears Tower building". 
Third, data values for Latitude, Longitude, and possibly altitude and accuracy could be sent from the BS or Location Center to the 
IS mobile stationAU ("LIT denoting . In order to be most easily useful to and end-user, in the first and third cases, a database would 
be needed within the mobile station or a Personal Digital Assistant device, which performs a translation of numerical data into a 
form useful for human understanding. 

The mobile station thus maintains a list of location pilot offsets, where the list is ranked based on a weighted 
combination of received signal energy and BS location. The mobile station selects the best candidate BSs for location estimate 
20 purposes, which may be slightly different from the Active, candidate and remaining lists. 

Additionally the mobile station may send a Data_Burst message back to the BS or Location Center, informing that no 
other Pilot Channels were detected. This "negative" Venn diagram information may be useful with various heuristics for location 
estimate deduction, for example, to note where the mobile station is not located. 

It is the difference of system time values (as opposed to their absolute values) that is important. Note that for purposes 
25 of location, any communication back to a BS 122 would require re-synchronizing onto that BS's system time. Although not specified 
in either IS-9S or Tl PI/|TCs PCS CDMA standards, most mobile station manufacturers build correlators with resolutions of 
approximately 1/8 PN chip, which is about 125 nS. A location equipped mobile station will provide +/- 125 nS. accuracy, which is 
about +/- 125 feet. 

The mobile station or location entity can process the arrival time estimates in at least two ways, first the mobile station 
30 may difference the measurements (preferred) to form time-difference-of-arrivals (TDOA); or second, the mobile station may 
determine absolute time-of-arrival (TOA) by solving for the clock bias between the mobile station and other CDMA system time 
reports. TOA requires very well calibrated BS system clocks among each other. 

The following procedure illustrates significant capabilities hidden in the CDMA standards, which provide a substantial 
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enabling base with which to provide the measurements and data for this inventions* location methods. 

First the BS sends the Neighbor List Update Message, containing a complete list of the neighboring pilot PN sequence 
offset indices (i.e M via the NGHBR _PN field) associated with candidate BSs in the area, with which the mobile station could 
possibly scan for detecting usable earliest arriving neighboring useable BS multipath components. This list should typically be a 

5 complete list, as opposed to the presumed candidate subset. If the mobile station is not already in the Traffic/Conversation State, it 
could invoke this state by calling a dialable telephone number in the network, e.g., a designed "Quiet Line" This approach also 
allows a billing record to be generated according to routine wireless telephony practice. If the network is to determine location, 
then the network pages the mobile station MO, connecting the mobile station to a Quiet Line/Voice message upon mobile station 
answer. Note that it may be desirable to suppress the mobile station ringer sounding for certain location applications. Other 

1 0 methods may also be possible. 

During installation, each BS 122 in a particular area is provisioned with the locations of all possible neighboring BSs in 
its area. The BSs 122 use this information to populate a list of all Latitudes and Longitudes which can be sent to the LUs, using the 
Neighbor List Update message. Second, assuming that the mobile station does not currently have this data or if unknown, then the 
BS shall send a series of Mobile Station Registered Messages, each message containing the latitude and Longitude values (i.e., the 

i S BASE LAT and BASELONG fields) associated with a neighboring BS pilot PN offset sent with the first message. Note that the 

constants N^ m , Supported Traffic Channel Candidate Active Set size, normally set to 6, and N7 m , Supported Traffic Channel 

Candidate Set size, normally set to 5, and N3 m , the Minimum Supported Neighbor Set size, normally set to 20, should be sufficient 

for most location purposes, however these constants could be changed if the need arises. 

Third, the BS saves the current T__ADD and T _DROP values in the BS memory, associated with the In-Traffic LU, and 

20 sends the In-Traffic System /fc/a/w/to Message, which includes reduced T ADD and T DROP parameter values, useable for 
location purposes. The value for T ADD would typically be set to a value near the lower end of the IS-98 specification, possibly 
below the 80 dB dynamic range requirement, close to (but not including) the thermal noise power level of the LI) receiver. Note 
that if the LU is using restricted battery, e.g., a portable, then the time for keeping T_ADD and T__DROP at a low value for location 
estimates purposes, should be kept short to conserve adverse consequences, such as increased current drain and noise. 

25 Reduced T_ADD and TJJROP values sent to the mobile station will cause the LU to scan all conceivable neighboring BS 

pilots provided to it by the BS, and to measure the strengths of each received pilot, and to determine the pilot arrival time for each 
pilot offset. Note that the signal strengths now measured may not be sufficient for carrying traffic, but may be sufficient for 
location purposes. 

Assuming the network is to determine location, then the mobile station reports the arrival time, PILOT ARRIVAL, for 
30 each pilot reported to the base station. According to the standard the arrival time is measured relative to the mobile station's time 
reference (which was previously determined from the active BS), in units of PN chips (1/2288) microseconds, or about 814 
nanoseconds, as follows: 
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IS 

PILOT_PN-PHASE= (PILOTARRIVAL + (64 X PILOT_PN))mod 2 , 

where PIL0T_PN is the PN sequence offset index of the pilot associated with the BS pilot indices in the neighbor list. 
In order to achieve location accuracy estimates on the order of a few hundred feet (or nanoseconds) a higher resolution 
than I PN chip is required. Although not specified directly in IS-95, most mobile manufacturers use correlators with resolutions of 
5 approximately 1/8 PN chip, or about 102 nS (suggesting that if no other systemic errors are present, about 102 feet of error is 

expected). Note that the search window size SRCH_WIN_A r for each pilot may need to be increased if there are substantial delays 

experienced from the environment. It is desirable for the mobile station to report the second and third arrival time (or the second 
and third fingers), and their relative signal strengths, corresponding to each detectable Pilot Channel. 

If more than one PILOT_ARRIVAL is available then a basic TDOA multilateral algorithm may be invoked, at either 
10 the LU, or the network. In the network case, the active BS 122 must send a Pilot Request Order for Pilot Measurement Request 
Order (ORDER code 010001), which causes the mobile station 140 to forward its measurements to the BS (and consequently the 
network, as appropriate). 

At this point a minimally sufficient number of measurements are available to perform a location estimate. Thus the BS 
should restore the original T_ADD and TJ)ROP values (previously saved in the BS memory) to the mobile station, via the In- 
15 Traffic System ParametersVltmge. 

Additional information may be desirable, such as the active BS* TOA measurement, as well as associated BS 
measurements of the mobile station's TOA to their BS location. This added information may be sent to the mobile station if the 
mobile station is to perform location, via the Data Burst Message on the forward Traffic Channel. Since 26 combinations of data 
burst types have been reserved for future use in the standard, dedication of several combinations could be used to telemeter 
20 location-related data. In cases where duplicate ranging or other information is available, various supervisor techniques mentioned 
elsewhere in this document, could be used to refine the location estimate. 

Once the location estimate has been performed, any number of means could be used to provide the results to the end 

user. 

The IS-9S and J-STD-008 CDMA specifications require that BSs should be synchronized to within +/- 3 microseconds of 
25 CDMA system time and shall be synchronized to within + /- 10 microseconds. This invention disclosure method assumes the cost of 
GPS receivers is relatively small, thus time calibration at a more precise calibration level at each location BS is recommended to be 
used by using the very accurate GPS time parameters. Preferably the absolute error deviation among surrounding or neighboring 
base stations should be less than 800 nanoseconds, however in most cases this should not be a fixed requirement, but rather a 
preference. In cases where absolute BS timing is prohibitively expensive, then the "Forced Hand-off" method discussed below can be 
30 used to overcome the preferred, or strict absolute BS timing requirements. 

Three methods have been currently identified. Some of these techniques apply to other air interface types as well. 
I. Use the first Finger at BS (Absolute Ranging), and if detecteable, invoke a "Forced Hand-off between the mobile station and a 
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neighboring BS, for a time sufficient to complete signal measurements between a mobile station transmitter and a BS 
receiver, and if possible, between a BS transmitter and a mobile station receiver, which gives access to as many BS's 
as can be detected either by the mobile station receiver or the surrounding BS receivers. 

2. Use the first finger at mobile station (Differential Ranging) to obtain differential time readings of pilot channel from mobile 
5 station 

3. Use the Pilot Power Level Measurements and Ground Clutter (Stochastic information) 

Now in the general case where three or more BSs can either determine TDOA and/or the mobile station can telemeter 

such data to the location entity within the network, repeat this method for BS} and BS3, and BS3 and BS| , in order to determine 

the remaining curves, thus yielding location within a 2D space. In the case of 3D geometry (such as a multi-story building with 
10 multi-floor pico BS cells), the process must be repeated a fourth time in order to determine altitude, 
MATLAB MathWorks code to implement the above algorithms follows: 
clear;hold off; 
j = sqrt(-l); 
step_size = 0.03; 

15 

# Set up BS variables 
theta = pi/3*ones(3J); 
D = I0*ones(3,l); 
2(l) = 0; 
20 z(2) = D(i); 

2 (3) = D(3)*exp(-j*theta(l)); 



# Define the distance parameters 
d = [0 6.4 -6.8]'; 
25 location I = 0; 

Iocation2 = Q; 
location3 = []; 



# Iterate and solve for the location with respect to the first BS (at (0 t 0) ) 
30 a = -pi:0.0S:0.05; 

fortl =-pi/3:0.05:0.05, 

tl = ti+aooi; 

rl = L/(exp(j*ti)-«p(j*t2))*(D(l)^(1)*exp(i*t2)); 
r2 = L/(exp(j*tl)-exp0*t2)) *(D(l)-d(l)*exp(j*tl)); 

60 



SUBSTITUTE SHEET (RULE 26) 



WO 98/10538 




PCT/US97/15933 



temp = arg(rl); 

index = find(abs(temp) = = min(abs(temp))); 
location! = [location I ;r I (index) * exp ( j *t I ) ] ; 
end; 

5 for tl = -piy3:0.05:0.05 

tl =tl +0.001; 

rl = l./(exp(j*tl)-exp(j*t2)) *(D(2)-d(2)*exp(j*t2)); 
r2 = L/(exp{j*tl)-exp(j*t2)) *(D(2)-d(2)*exp(j*tl)); 
temp = arg(rl); 

10 index = find(abs(temp) = = min(abs(temp))); 

location2 = [iocation2;rl(index)*exp(j*tl)]; 
end; 

for tl = -pi/3:0.05:0.05 
tl = tl +0.001; 

15 rl = I7(exp(j*tl)-€xp(j*t2)) *(D(l)Ki(3)*exp(j*t2)); 

r2 = l./(exp(j*tl)-exp(j*t2)) *(D(l)-d(3)*exp(j*tl)); 
temp = arg(rl); 

index = find(abs(temp) — = min(abs(temp))); 
location3 = [location3;rl(index)*exp(j*tl)]; 
20 end; 

location2 = location2*exp(j*arg(z(3)-z(2))) + z(2); 
Iocation3 = location3*exp(j*arg(z(l)-z(3))) + z(3); 
setyrange [-10:1]; 
set xrange [-1:11]; 
25 plot([a(l)]) 
hold on 

plot(tocationl) 
plot(location2) 
plot(location3) 



WIRELESS LOCATION DATA COLLECTION 

It is worthwhile to discuss techniques for both obtaining the initial collection of verified location data, as well as how 
additional location data can be obtained for updating the data in this data base in a straightforward cost-effective manner. 

Regarding both the obtaining of the initial collection of verified location data as well as gathering data updates, it is 
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believed that some of this data can be obtained from the initial and continued engineering of the base station infrastructure by the 
wireless telephony service provider(s) in the radio coverage area. Additional verified location data can be obtained by trained 
technicians driving and/or walking certain areas and periodically, at each of a plurality of locations: (a) determining a location 
estimate (using, for example, GPS if possible and/or offsets from GPS readings); and (b) using an mobile station 140 at the location 
to generate location data communication with the wireless base station infrastructure. 

Alternatively, it is a novel aspect of the present invention that a straightforward method and system for gathering 
verified location data has been discovered, wherein a conventional mobile station 140 can be used without any additional 
electronics or circuit modifications. One embodiment of this method and system utilizes the personnel of businesses that travel 
predetermined routes through the radio coverage area (e.g., a deiivery and/or pickup service) to generate such data using a 
conventional mobile station 140 while traversing their routes through the radio coverage area. One example of such personnel is 
the postal workers, and in particular, the mail carriers having predetermined (likely repetitive) routes for mail pickup and/or 
delivery at predetermined sites (denoted hereinafter as "mail pickup/delivery sites" or simply "mail sites"). By having such mail 
carriers each carry a conventional mobile station 140 and periodically generate location data communication with the wireless 
base station infrastructure at mail sites along their routes, additional verified location data can be added to the Location Data 
Base 1 1 29 cost effectively. 

To describe how this can be performed, a brief description of further features available in a typical mobile station 140 is 
needed. At least some modules of mobile station 140 have the following capabilities: 

(27.2.1) a unique mobile station 140 identification number; in fart, every mobile station 140 must have such a number 
(its telephone number); 

(27 2 2) the mobile station 140 has a display and a display memory for presenting stored data records having 
telephone numbers and related data to a user. Further, some portion of each data record is annotation and some portion is able to 
be transmitted to the wireless base station network. In particular, the mobile station 140 is able to store and recall data records of 
sufficient size such that each data record may include the following information for a corresponding mail pickup/delivery site along 
a mail route: (a) an address or other textual description data (e.g., an English-like description) of the mail pickup/delivery site; (b) 
a predetermined telephone number; and (c) a numerical code (denoted the "site code" hereinafter) associated with the mail 
pickup/delivery site, wherein the site code is at least unique within a set of site codes corresponding to the mail sites on the mail 
route. In one embodiment, the memory may store 99 or more such data records, and the display is scrollable through the data 
records; 

(2723) the mobile station 140 can have its display memory updated from either an RS232 port residing on the mobile 
station, or from an over-the-air activation capability of the wireless network; 

(272.4) the mobile station 140 has a pause feature, wherein a telephone number can be dialed, and after some 
predetermined number of seconds, additional predetermined data can be transmitted either through additional explicit user 
request (e.g., a "hard pause"), or automatically (e.g^ a "soft pause"). Moreover, the additional predetermined data can reside in 
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the display memory. 

Assuming these features, the following steps can be performed for acquiring additional verified location data: 
(27 3.1) For (at least some of the) postal carriers having predetermined routes of addresses or locations visited, the 
postal carriers are each provided with an mobile station 140 having the capabilities described in (27.2.1) through (27 2A) above, 
wherein the memory in each provided mobile station has a corresponding list of data records for the addresses visited on the route 
of the postal carrier having the mobile station. Moreover, each such list has the data records in the same sequence as the postal 
carrier visits the corresponding mail sites, and each data record includes the information as in (27.2.2) for a corresponding mail 
site the postal carrier visits on his/her mail route. More precisely, each of the data records has: (a) a description of the address or 
location of its corresponding mail pickup/delivery site, (b) a telephone number for dialing a data collection system for the location 
center 142 (or, alternatively, a reference to a memory area in the mobile station having this telephone number since it is likely to be 
the same number for most data records), and (c) a site code for the mail pickup/delivery site that is to be transmitted after a 
predetermined soft pause time-out. Note that the corresponding list of data records for a particular postal route may be 
downloaded from, for example, a computer at a post office (via the RS232 port of the mobile station 1 40), or alternatively, the list 
may be provided to the mobile station 140 by an over-the-air activation. Further, there are various embodiments of over-the-air 
activation that may be utilized by the present invention. In one embodiment, the postal carrier dials a particular telephone number 
associated with data collection system and identifies both him/herself by his/her personal identification number (PIN), and the 
postal route (via a route identifying code). Subsequently, the mail pickup and delivery sites along the identified route are 
downloaded into the memory of the mobile station 140 via wireless signals to the mobile station 140. However, additional over- 
the-air techniques are also within the scope of the present invention such as: 

(a) If the postal carrier's route is already associated with the carrier's PIN for over-the-air activation, then the carrier may only 

need to enter his/her PIN. 

(b) If the mobile station 140 is already associated with a particular route, then the carrier may only need to activate the mobile 

station 140, or alternatively, enter his/her PIN for obtaining an over-the-air download of the route. 

(c) Regardless of how the initial download of mail sites is provided to the mobile station 140, it is also an aspect of the present 

invention that if there are more mail sites on a route than there is sufficient memory to store corresponding data 
records in the mobile station, then the data records may be downloaded in successive segments. For example, if 
there are ISO mail sites on a particular route and storage for only 99 data records in the mobile station, then in one 
embodiment, a first segment of 98 data records for the first 98 mail pickup/delivery sites on the route are 
downloaded together with a 99 th data record for transmitting an encoding requesting a download of the next S2 
data records for the remaining mail sites. (Alternatively, the data collection system may monitor mobile station 
140 requests and automatically detect the last location capture request of a downloaded segment, and 
subsequently automatically download the next segment of mail site data records). Accordingly, when the data 
records of the first segment have been utilized, a second segment may be downloaded into the mobile station 140. 

63 



SUBSTITUTE SHEET (RULE 26) 



WO 98/10538 




PCT7US97/15933 



Moreover, at the end of the last segment, the data collection system may cause the first segment for the route to be 
automatically downloaded into the mobile station 140 in preparation for the next traversal of the route. 
(273 J) Given that a download into the mobile station 140 of (at least a portion of) the data for a postal route has occurred , 
the postal carrier traversing the route then iteratively scrolls to the next data record on the list stored in the 
mobile station as he/she visits each corresponding mail pickup/delivery site, and activates the corresponding data 
record. That is, the following steps are performed at each mail pickup/delivery site: 

(a) As the postal carrier arrives at each mail pickup/delivery site, he or she checks the scrollable mobile station 140 display to 

assure that the address or location of the mail pickup/delivery site is described by the data record in the portion of 
the mobile station display for activating associated data record instructions. 

(b) The postal carrier then merely presses a button (typically a "send" button) on the mobile station 1 40 for concurrently dialing 

the telephone number of the data collection system, and initiating the timer for the soft pause (in the mobile 
station 140) associated with the site code for the mail pickup/delivery site currently being visited. 

(c) Given that the soft pause is of sufficient length to allow for the data collection system call to be setup, the mobile station 140 

then transmits the site code for the present mail pickup/delivery site. 

(d) Upon receiving the telephone number of the mobile station 140 (via automatic number identification (AIN)), and the site code, 

the data collection system then performs the following steps: 

(dl) A retrieval of an identifier identifying the route (route id). Note this may be accomplished by using the telephone number of 
the mobile station. That is, when the data collection system first detects that the mobile station 140 is to be used 
on a particular route, the telephone number of the mobile station and the route id may be associated in a data base 
so that the route id can be retrieved using the telephone number of the mobile station. . 

(d2) A retrieval of a location representation (e.g., latitude, longitude, and possibly height) of the mail pickup/delivery site 

identified by the combination of the route id and the site code is performed by accessing a data base having, for 
each mail site, the following associated data items: the route id for the mail site, the site code, the mail site address 
(or location description), and the mail site location representation (e.g., latitude, longitude, possibly height). 

(d3) A request to the location center 142 is issued indicating that the location data for the mobile station 140 (resulting from, 
e.g., the call being maintained between the mobile station and the data collection system) is to be retrieved from 
the wireless network, temporarily saved, and a location estimate for the mobile station is to be performed. 
Accordingly, the data collection system request to the location center 142 the following: 

(i) the telephone number of the mobile station 140; 

(ii) the retrieved location of the mobile station 140 according to the route id and site code; 

(iii) a request for the location center 142 to perform a location estimate on the mobile station 140 and return the location 

estimate to the data collection system; 

(iv) a request that the location center 142 retain the location for the mobile 
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station 140 and associate with it the location of the mobile station 140 received from the data collection system. 
Regarding step (iii), the location estimate may also include the steps temporarily increasing the mobile station 
transmitter power level 

(2733) Subsequently, given that the location center 142 performs as requested, when the data collection system receives the 
5 mobile station 140 location estimate from the location center, the data collection system first associates the returned mobile 
station location estimate with the corresponding data collection system information regarding the mobile station, and 
secondly, performs "reasonability" tests on the information received from the mobile station 140 for detecting, filtering 
and/or alerting systems and personnel whenever the postal carrier appears to be transmitting (via the mobile station 140) 
from a location different from what the route id and site code indicate. The following are examples of such reasonability tests: 
10 (a) If a threshold number of postal carrier transmittals disagree with the location center 142 estimate by a predetermined distance 
(likely dependent upon area type), then tag these particular transmittals as problematic and mark all transmittals 
from the mobile station 140 as suspect for "distance" inaccuracies. 

(b) If there is less than a threshold amount of time between certain postal carrier transmittals, then tag these particular 

transmittals as problematic and mark all transmittals from the mobile station 140 as suspect for "time" 
15 inaccuracies. 

(c) If an expected statistical deviation between a sampling of the postal carrier transmittals and the location estimates from the 

location center 142 vary by more than a threshold amount, then tag these particular transmittals as problematic 
and mark all transmittals from the mobile station 140 as suspect for "statistical" inaccuracies. 

(d) If an expected statistical deviation between a sampling of the times of the postal carrier transmittals and an expected timing 
20 between these transmittals vary by more than a threshold amount, then tag these particular transmittals as 

problematic and mark all transmittals from the mobile station 140 as suspect for "statistical" inaccuracies. 

(273.4) When suspect or problematic mobile station location information is detected (e.g., incorrect site code) in step (2733), the 
data collection system may perform any of the following actions: 

(a) Alert the postal carrier of problematic and/or suspected inaccuracies in real time, after a certain number of transmittals or at a 
25 later time. Note that such alerts as well as positive feedback at the end of the postal carrier's route (or segments 

thereof) may be advantageous in that it likely inhibits the postal carrier from experimenting with transmittals from 
locations that are purposefully inaccurate, but at the same time provides sufficiently timely feedback to encourage 
a conscientious postal carrier. 

(b) Alert the Postal Service of perceived discrepancies in the mobile station 140 transmittals by the postal carrier. 
30 (c) Dispatch location center technicians to the area to transmit duplicate signals. 

(273.5) If the transmittal(s) from the mobile station 140 are not suspect, then the data collection system communicates with the 
location center 142 for requesting that each location received from the mobile station 140 be stored with its corresponding 
retrieved location (obtained in step (d2)) as a verified location value in the Location Data Base 1 129. Alternatively, if the 
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transmittals from the mobile station 140 are suspect, then the data collection system may communicate with the location 
center 142 for requesting that at least some of the location data from the mobile station 140 be discarded. 

Note that a similar or identical procedure to the steps immediately above may be applied with other services/workers 
such as courier services, delivery services, meter readers, street sweepers, and bus drivers having predetermined routes. 

5 WIRELESS LOCATION APPLICATIONS 

After having determined wireless location from a base technology perspective, several applications are detailed below, 
which provide the results of the location information to a variety of users in various channels and presentation schemes, for a 
number of useful reasons and under various conditions. The following applications are addressed: (I.) providing wireless location to 
the originator or another, using either the digital air interface voice channel or a wireline channel, and an automatic call 

i 0 di siribuior; (1) providing wireless location to the originator, or another, using either the digital air interface voice channel or a 
wireline channel, and a hunt group associated with the central office or a PBS group; (3.) providing wireless location to the 
originator or another, using either the digital air interface text paging, or short message service communications channel; (4.) 
providing wireless location to the originator or another, using the Internet, and in one embodiment, using netcasting or "Push" 
technology; (5.) selective group, multicast individualized directions with optional Conferencing; (6.) rental car inventory control 

15 and dispatch; (7.) vocalized directions and tracking; (8.) wireless location and court ruling/criminal incarceration validation; (9.) 
flexible delivery of wireless location information to public safety answering points; (10.) trigger-based inventory and tracking; (II.) 
group, e.g., family, safety and conditional notification; (12.) wireless location-based retail/merchandising services; (13.) location- 
based home/office/vehicle security management; (13.) infrastructure-supported wireless location using hand-actuated directional 
finding; (14.) infrastructure-supported intelligent traffic and highway management; (15.) Parametric-driven intelligent agent- 

20 based location services. Each of these wireless location applications is discussed in detail below. 

Referring to Fig. 36, a user (the initiating caller) desiring the location of a target mobile station 140a, such as a user at 
a telephone station 162 which is in communication with a tandem switch 489 or a user of an mobile station 140b, or any other 
telephone station user, such as a computer program, dials a publicly dialable telephone number which terminates on the automatic 
call distributor 546 (ACD), associated with the location center 142. If the caller originated from an mobile station 102, then the call 

25 is processed via a base station 122 to a mobiles switch center 108. The mobile switch center recognizes the call is to be routed to the 
PSTN 124 via an interoffice trunk interface 600. The PSTN 124 completes the call to the ACD 546, via a trunk group interface 500. 
Note that the initiating caller could access the ACD 546 in any number of ways, including various Inter-LATA Carriers 492, via the 
public switched telephone network (PSTN) 124. The ACD 546 includes a plurality of telephone network interface cards 508 which 
provide telephony channel associated signaling functions, such as pulse dialing and detection, automatic number identification, 

30 winking, flash, off-hook voice synthesized answer, dual tone multi frequency (DTMF) detection, system intercept tones (i.e„ busy, 
no-answer, out-of-service), disconnected, call progress, answer machine detection, text-to-speech and automatic speech 
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recognition. Note that some of these functions may be implemented with associated digital signal processing cards connected to the 
network cards via an internal bus system. An assigned telephone network interface card 508 detects the incoming call, provides an 
off-hook (answer signal) to the ailing party, then provides a text to speech (TTS) message, via an assigned text-to-speech card 5 1 2 
indicating the nature of the call to the user, collects the automatic number identification information if available (or optionally 
5 prompts the caller for this information), then proceeds to collect the mobile identification number (M IN) to be located. MIN 

collection, which is provided by the initiating caller through keypad signaling tones, an be achieved in several methods. In one case 
the network card S08 an request a TTS message via text-to-speech card 512, which prompts the initiator to key in the MIN number 
by keypad DTMF signals, or an automatic speech recognition system an be used to collect the MIN digits. After the MIN digits have 
been collected, a location request message is sent to a location application 146. The location application 146, in concert with 

10 location application interface 135, in the location system 42, is in communication with the location engine 139. Note that the 
location engine 139 consists of the signal processing subsystem 20, and one or more location estimate modules, i.e., DA module 10, 
TOA/TDOA mocule 8 or HBS module 6. The location engine 139 initiates a series of messages, using the location application 
programming interface 136 to the mobile station 108. The location application programming interface 136 then communicates with 
one or more mobile switch centers 108, to determine whether or not the mobile station 140 to be located can be located. Conditions 

15 regarding the locateability of an mobile station 140 include, for example: mobile station 140 powered off, mobile station 140 not in 
communication range, mobile station 140 roaming state not known, mobile station 140 not provisioned for service, and related 
conditions. If the mobile station 140 cannot be located then an appropriate error response message is provided to the initiating 
alter, via e-mail, using the web server 464 in communications with the Internet 468 via an Internet access channel 472 or 
alternatively the error response message may be sent to a text to speech card 512, which is in communications with the initiating 

20 caller via the telephone interface card 508 and the ACD 546, which is in communication via telephony interface circuits 500 to the 
PSTN 124. 

Note that in cases where rendering location estimate information is required on the Internet, the web server cna include 
the provision of a digital certificate key, thus enabling a secure, encrypted communication channel between the location web server 
and the receiving client. One such digital encryption key capability is a web server provided by Netscape Communications, Inc. and 

25 a digital certificate key provided by Verisign, Inc. both located in the state of California, U.SJL 

The PSTN 124 completes routing of the response message to the initiating caller via routine telephony principles, as one 
skilled in the art will understand. Otherwise the mobile station 140 is located using methods described in greater detail elsewhere 
herein. At a high level, the mobile switch center 1 12 is in communication with the appropriate base stations 122, and provides the 
location system 42 with the necessary signal and data results to enable a location estimation to be performed by the location engine 

30 139. Once the location has been determined by the location engine 139 in terms of Latitude, Longitude and optionally height if 
known (in the form of a text string), the result is provided by to the initiator by inputting the location text string to a text-to- 
speech card 512, in communiation with the assigned telephone interface card 508, via the automatic control distributor 546, 
completes the communiation path and location response back to the initiating user via the telephone interface 500 to the PSTN 
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124, and from the PSTN 124 to the initiating user. 

Alternatively the location results from the location application 146 could be provided to the initiating caller or Internet 
user via a web server 464 in communication with the Internet 468, via an Internet access channel 472 and a firewall 474. In 
another embodiment, the location results determined by the location application 146 may be presented in terms of street addresses, 
5 neighborhood areas, building names, and related means familiar to human users. The alternative location result can be achieved by 
previously storing a relationship between location descriptors familiar to humans and Latitude and Longitude range values in a 
map database 538. During the location request the location application 146 accesses the map database S38, providing it with the 
Latitude and Longitude information in the form of a primary key which is then used to retrieve the location descriptor familiar to 
humans. Note that to those skilled in the art, the map database 538 and associated messaging between the map database 538 and 
10 the location application 146 can be implemented in any number techniques. A straightforward approach includes defining a logical 
and physical data model using a relational database and designer environment, such as "ORACLE 2000" for the design and 
development, using a relational database, such as the "ORACLE 73" database. 

In an alternative embodiment, the location application 146 may be internal to the location system 142, as one skilled in 
the art will understand. 

15 Referring to Fig. 37, a user - the initiating caller, such as an mobile station 140b or desiring the location of an mobile 

station 140a, signals to the primary base station 122, in connection with the mobile switch center 108 via transport facilities 176, 
The mobile switch center 1 12 is connected to the PSTN 124, via interoffice trunks 600. The initiating user dials a publicly dialable 
telephone number which is then routed through an end office 496, to a telephone interface card 247, via a telephone hunt group 
500. The hunt group 500 provides a telephony connection to the interface card 247 associated with the location system 228. The 

20 hunt group trunk interface 500 is provided from an end office telephone switch 496. Note that the initiating caller could access the 
telephony interface card 508, via hunt group trunk interface 500 in any number of ways, including an InterLATA Carrier 492, via 
the public switched telephone network (PSTN) 124. The hunt group trunk interface 500 is in communication with a plurality of 
telephone interface cards 508. The interface cards 247 provide telephony channel associated signaling functions, such as pulse 
dialing and detection, automatic number identification, winking, flash, off-hook voice synthesized answer, dual tone multi 

25 frequency (DTMF) detection, system intercept tones (i.e., busy, no-answer, out-of-service), disconnected, call progress, answer 
machine detection, text-to-speech and automatic speech recognition. An assigned network interface card 247 detects the incoming 
call, provides an off-hook (answer signal) to the calling party, then provides a text to speech (TTS) message indicating the nature 
of the call to the user, collects the automatic number identification information if available (or optionally prompts the caller for 
this information), then proceeds to collect the mobile identification number (MIN) to be located. MIN collection can be achieved in 

30 several methods. In one case the network card 247 can request a TTS message, generated by a voice synthesizer or text to speech 
card 5 12, which prompts the initiator to key in the MIN number by keypad tone signals, or an automatic speech recognition system 
can be used to collect the KIN digits. After the MIN digits have been collected, a location request message is sent to an application 
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146 in the location system 42. The application 146 in location system 42 initiates a series of messages to the mobile switch center 
1 12, and optionally to the home location register 460, to determine whether or not the mobile station 140 to be located can be 
located. If the mobile station 140 cannot be located then an appropriate error response message is provided to the initiating caller, 
via e-mail, test to speech card 5 12, web server 464 in communications with the public Internet 468, or similar means. Alternatively 

5 the last known location can be provided, along with the time and date stamp of the last location, including an explanation that 
current location is not attainable. Otherwise the mobile station 140 is located using methods described in greater detail elsewhere 
in this patent. At a high level, the mobile switch center 1 12 is in communication with the appropriate base stations 122 and I22h, 
and provides the location system 42 with the necessary signal and data results to enable a location estimation to be performed by 
the location system 42. Once the location has been determined by the location system 42 in terms of Latitude, Longitude and 

10 optionally height if known (in the form of a text string), the result is provided back to the initiator by inputting the location text 
string to a text-to-speech card SI2, in communication with the assigned telephone interface card 508. The interface card 508 then 
provides the audible, synthesized message containing the location estimate to the initiating caller. Alternatively the location results 
could be provided to the initiating caller via a web server 464 in communication with the Public Internet 468, using standard client 
request-response Internet protocols and technology, location system 42 access to a geographical information system or other 

IS mapping system could also be used to further enhance the user understanding of the location on a map or similar graphical display. 

Referring to Fig. 38, a user (the initiating caller) desiring the location of an mobile station 140, such as a wireless user 
140 who has text paging service provisioned, dials a publicly dialable telephone number, carried to the PSTN 124 which terminates 
on an end office 496 based hunt group interface 500, which in turn is in communication with the location system 142. The mobile 
switch center 112, local tandem 317 and tnterLATA Carrier tandem 362 are in communication with the PSTN 124, as those skilled in 

20 the art will understand. Note that the initiating caller could also be a wireline user with an ordinary telephone station 162 in 

communication with a local tandem 489, connected to the PSTN 124. The initiating location request user could access the telephony 
interface cards 512 via the hunt group 500. In other embodiments, including various Inter-LATA Carriers 492, via the public 
switched telephone network (PSTN) 124. The hunt group interface 500 is in communication with a plurality of telephone network 
interface cards 512, which are in communication with the location application 146 . The telephone interface cards 512 provide 

25 telephony channel associated signaling functions, such as pulse dialing and detection, automatic number identification, winking, 
flash, off-hook voice synthesized answer, dual tone multi frequency (DTMF) detection, system intercept tones (i.e., busy, no-answer, 
out-of-semce), disconnected, call progress, answer machine detection, text-to-speech and automatic speech recognition. Note that 
some of these functions may be implemented with associated digital signal processing cards connected to the network cards via an 
internal bus system. An assigned telephony interface card 508 detects the incoming call, provides an off-hook (answer signal) to 

30 the calling party, then provides, if appropriate, a text to speech (TTS) message indicating the nature of the call to the user, collects 
the automatic number identification information if available (or optionally prompts the caller for this information), then proceeds 
to collect the mobile identification number (MIN) to be located by sending a location request message to an application 146 in the 
location system 42. The mobile station MIN collection, provided through the communications channel established, is sent by the 
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initiating alter through keypad signaling tones. This MIN colleaion process can be achieved in several methods. In one case the 
telephony interface card 512 can request a text-to-speech message, generated by a text-to-speech card 512, which prompts the 
initiator to key in the MIN number by keypad tone signals. In another case an automatic speech recognition system can be used to 
collect the MIN digits. In either case after the MIN digits have been collected, a location request message is sent to the location 

5 system 142. The location system 42 initiates a series of messages to the mobile switch center 1 12, via the location applications 
programming interface (L-API) 366, and optionally to the home location register 360, to determine whether or not the mobile 
station 140 to be located can in fact be located. Alternatively the last known location can be provided, along with the time and date 
stamp of the last location, including an explanation that current location is not attainable. Conditions regarding the locateability 
of an mobile station include, for example: mobile station 140 powered off, mobile station not in communication range, mobile 

10 station roaming state not known, mobile station 140 not provisioned for service, and related conditions. If the mobile station 140 
cannot be located then an appropriate error response message is provided to the initiating caller, via the service node for short 
messaging service 367. The service node is in communication with the location system 42 using a common text paging interface 
369. The service node 107 accepts the location text paging message from the location system 42 and communicates a request to 
page the initiating caller via a typical signaling system 7 link for paging purposes, to the mobile switch center 112. The mobile 

15 switch center 112 forwards the location text page information to the initiating caller via the appropriate base stations 352 or 354, 
to the initiating mobile station 354. Otherwise the mobile station 140 is located using methods described in greater detail 
elsewhere in this patent. At a high level, the mobile switch center 1 12 is in communication with the appropriate base stations 352, 
354, and provides the location system 42 with the necessary signal and data results to enable a location estimation to be performed 
by the location system 42. Once the location has been determined by the location system 42 in terms of Latitude, Longitude and 

20 optionally height if known (in the form of a text string). The location result is provided by to the initiator by inputting the location 
text string to the service node for short messaging service 367. The service node is in communication with the location system 42 
using a common text paging interface 369. The service node 367 accepts the location text paging message from the location system 
42 and communicates a request to page the initiating caller via a typical signaling system 7 link for paging purposes, to the mobile 
switch center 1 1 2. The mobile switch center 1 12 forwards the location text page information to the initiating caller via the 

25 appropriate-base stations 122a or 122b, to the initiating mobile station 140, via a text-to-speech card 5 12, in communication with 
the assigned telephone interface card 508. 

Referring to Fig. 39, a user (the initiating user) desiring the location of an mobile station 140, who has a push 
technology tuner 484 associated with the user's client workstation 484, selects the location channel in the area, and further 
specifies the mobile station(s) to be located, with what frequency should the location estimate be provided, and other related 
30 parameters, such as billing information. The user's client workstation 482 is in communication with the Internet, optionally via and 
encrypted communications channel using, for example, Netscape's SSL 3 encryption/decryption technology. A push transmitter 472, 
connected to the Internet 468 via a web server 464, detects the client workstation 482 user's request The transmitter 472 requests 
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location update information for specified mobile identification numbers through a firewall 474 and a publisher 478, in 
communication with a location channel application 429 in the location system 42. The location system 42 initiates location requests 
for all mobile station mobile identification numbers for which location information has been subscribed to, then provides the 
location results to the location channel application 429. 
5 The location system 42 initiates a series of messages to the mobile switch center 1 12, via the location applications 

programming interface (L-API) 136, and optionally to the home location register 460, to determine whether or not the mobile 
station 140 or others, to be located an in fact be located. Alternatively the last known location can be provided, along with the 
time and date stamp of the last location, including an explanation that current location is not attainable. Conditions regarding the 
locatability of an mobile station 140 include, for example: mobile station 140 powered off, mobile station not in communication 

10 range, mobile station 140 roaming state not known, mobile station 140 not provisioned for service, and related conditions. If the 
mobile station 140 cannot be located then an appropriate error response message is provided to the initiating client workstation, • 
via the push technology components location channel application 429, publisher 478, firewall 474, transmitter 472, web server 464, 
public Internet 468, to the client workstation 482. A similar communication mechanism is used to provide the subscribed-to client's 
workstation 482 with attained location information. 

IS Note that the location channel could in fact provide a collection of mobile station 140 mobile identification numbers for 

location purposes that are grouped by a particular market and/or customer organization segment, for example, location channel 
number I could provide enhanced wireless 9-1-1 service to specific public safety answering points, channel number 2 could provide 
periodic wireless location information of a fleet of taxi cabs belonging to a particular company, to their dispatch operator, channel 
3 could provide wireless location to a control center of a military organization, channel 4 could provide wireless location 

20 information of vehicles carrying hazardous materials, to a control center, and so forth. 

The location channel application 429 provides the location results to the publisher 478, which provides a method of 
adding the new location results to the transmitter, via firewall 474. The firewall 474, provides protection services between certain 
systems and the Internet, such as preventing malicious users from accessing critical computing systems. 



25 The group multicast help, with individualized directions, are those whose are authorized and nearest, with text paging 

message instructions on how to drive or navigate, to reach the initiating distress caller. Alternatively optional voice synthesis 
technology could be used to aid one or more members to have spoken instruction giving directions and/or instructions for each 
member, to help them reach the distress caller. 

Referring to Fig. 40, an individual having a mobile station desires to make a distress call for help, or for some other 

30 reason. The distress caller with mobile station 102 dials a special telephone number, received by base station 104, which then sends 
the originating call setup request to the mobile switch center 108. The mobile switch center 1 08 routes the originating call through 
the PSTN 1 12 to an automatic call distributor (ACD) 116. The ACD 1 16 selects an available telephony interface circuit 120, which 
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answers the call and providing introductory information to the caller, such as a greeting message, progress of service, etc, using a 
voice synthesizer circuit card 124. Note that circuits 120 and 124 may be combined as voice response units. The telephony interface 
circuit 120 collects the automatic number identification information if available in the call setup message or optionally prompts the 
caller for this information. This MIN collection process can be achieved in several methods. In one case the network telephony 
5 interface card 120 can request a TTS message, generated by a voice synthesizer card 124, which prompts the initiator to key in their 
MIN number by keypad tone signals. In another case an automatic speech recognition system can be used to collect the MIN digits. 
In either case after the MIN digits have been collected, a location request message is sent to the location system 128. The location 
system or location system or center (LC) 128 initiates a series of messages to the mobile switch center 108, via the location 
applications programming interface (L-API) 166, to determine whether or not the mobile station 102 to be located can in fact be 

10 located. If the mobile station 102 cannot be located then an appropriate error response message is provided to the initiating caller. 
Otherwise the LC 128 determines the caller's location via methods discussed elsewhere in this patent. While this event is proceeding 
an application in the LS 128 references the initiating caller's location subscriber profile database 158 to determine if the caller 
allows others to locate him or her, and specifically which individuals are allowed to be informed of the caller's location. 

Assuming the caller allows location information to be sent out to a select group, then the list of members mobile station 

15 identification numbers (MIN)s are extracted from the profile database 158, and an application in the LC 128 initiates a series of 
messages to the mobile switch center 108, via the location applications programming interface (L-API) 166, to determine the 
locations of each of the users' mobile station mobile identification numbers associated with the member list. Regarding those 
mobile station mobile identification numbers nearest the distress caller, each member mobile station is dialed via a control message 
sent from an application in the LC 128 to the telephony interface card 120. A voice synthesizer card 124 or text to speech circuit is 

20 also patched in the calling circuit path, to announce the purpose of the automated call to each member. The ACD 1 16 initiates the 
call request to each member via the PSTN 1 12, which connects to the mobile switch center 108, that ultimately rings the member 
mobile station 140 and 148 via base stations 132 and 152. An application in the LC 128 identifies a start and finish location 
destination location for a member, based on his/her current location as being the start location, and the finish location being the 
distress caller's location at mobile station MIN 102. The application in the LC 128 initiates a http or similar Internet compatible 

25 protocol universal resource locator (URL) request via the web server/client 162 to the public Internet 163, which terminates on a 
maps, directions web server 164. One such URL known to the authors is Lucent Technologies' http://www.mapsOnUs.com, which is 
provided for public use. The map/directions server 164 queries the map base 168 via a directions algorithm 170, and returns to the 
initiating http request, the location web server 162, with a list of instructions to enable a user to navigate between a start location 
and end location. Referring to Fig. 41, the information shown in the columns labeled "Turn #", "Directions", "And Go", and/or 

30 "Total Miles", can then be parsed from the http response information. Referring now to Fig. FIG. 40, this information can then be 
sent as a short text message, to the relevant mobile station 148 or 140 via the service node 182, using interface 557 to the mobile 
switch center 108, and relevant base stations 152 and 132, assuming each member mobile station has short message service 
provisioned. If this is not the case, the service node 182 will inform the application within the LS 128, which then initiates an 
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alternative method of sending the start-finish location navigation instructions information via an appropriate voice synthesizer 
an! 124 and associated telephony interface card 120. The interface card 120 initiates an automated call to each appropriate 
member's mobile station 148 and 140, via the telephony path including components ACD 1 1 6 in communication with the PSTN I I2 t 
which is in communication with the mobile switch center 108. The mobile switch center 108 completes the routing of the automated 

5 call to the appropriate mobile station 148 and 140 using base stations 152 and 132 respectively. The above process is repeated for 
each nearby member's mobile station, thus allowing all nearby members to be notified that the distress caller needs help, with 
navigation instructions to each member, which enables the member to reach the distressed caller. Variations of this application 
include putting each relevant party in communication with each other via a conference call capability in the ACD 1 1 6, with or 
without providing location information and/or start-finish navigation instructions. 

10 An application in the location system utilizes periodic wireless location of appropriate rental cars, control circuits and 

control communications within the rental car, and secured transactions across the Internet, or similar means, in order to provide 
various tracking and control functions. Such functions allow rental car agencies to remotely control and operate their rental cars in 
order to reduce operating costs such as storage and maintenance, as well as provide additional conveniences and services to rental 
car agency customers. 

15 Referring to Fig. 42, a vehicle 578 containing various sensors and actuators (not shown) used to, for example, lock and 

unlock car doors, sense door position, keypad depressions, sense the condition of the engine and various subsystems, such as 
brakes, electrical subsystems, sense the amount of various fluid levels, etc., is in communication with a vehicle-based local area 
network 572, which is in turn connected to a mobile station 140 containing asynchronous data communications capability. The 
vehicle-based local area network may optionally contain a computer (not shown) for control and interfacing functions. The mobile 

20 station 140 is always in communication, using the radio air interface with at least one base station I22g, and possibly other base 
stations I22h. The base stations I22g and I22h are in communication with the mobile switch center 112 via transport facilities 178. 
The mobile switch center 1 12 is in communication with the location system 142 and the public switched telephone network 126 via 
interoffice trunks 600. In addition the mobile switch center 112 is also in communication with the location system 142 via the 
location system - mobile switch center physical interface 178. The physical interface provides two-way connections to the location 

25 applications programming interface (L-API-MSC) 136, which is in communication with a location engine 139, which performs 
wireless location estimations for the mobile station, which is permanently mounted in the vehicle 578. The location engine 
represents key components within the location system which together comprise the capability to perform wireless location 
estimations. The rental car location application 146 is in communications wither the location engine 139 for purposes of initiating 
wireless location requests regarding the mobile station 140, as well as for receiving wireless location responses from the location 

30 engine 139. The application 146 is in communications with the automatic call distributor 546 for purposes of initiating and 
receiving telephone calls to and from the public switch telephone network 126, via hunt group interface 500. As one skilled in the 
art will appreciate, other interfaces (not shown) beyond hunt groups 500, can alternatively be used, such as ISDN interface circuits, 
T-carrier and the like. The application 146 is in communication with a web server and client 464, which in turn is in communication 
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with the Internet 468 via an Internet access interface 472. As those in the art will understand, an Internet access interface is 
typically provided by an Internet service provider, also there are other methods which could be used to complete the Internet 
connection. The rental car agency contains a workstation or personal computer S82 with an Internet access interface 472 to the 
Internet 468. The application 146 requests of the location engine to perform a location request periodically regarding the mobile 

5 station 140, with the location response information provided the web server and client, 464. For each rental car or vehicle 

containing a mobile station 140, the location, as well as various information about the rental car or vehicle can be ascertained via 
the above described infrastructure. 

An application in the location system operates in conjunction with an application in each public safety answering point 
(PSAP) that together provides various call handling functions to enable the PSAP to perform its work load efficiently and effectively 

10 toward unique emergency events unique to a given location. The application pair measures the number of emergency 9-1-1 wireless 
calls originating from a particular geographical area or location. Upon exceeding a provisional threshold value "X", the application 
pair traps the next incoming all from the same location and provides a call screening function via a play announcement and collect 
digits activity. This activity alerts the originating caller that if their call relates to an incident at a particular location, then they are 
the "X + 1 th w caller who has already notified the PSAP, and that no further caller discussion is required. However, if the caller's 

15 intent does not relate to the incident described above, then the alter is requested to press or say "one", or some similar keypad 
number, which then is collected and causes the caller to be re-routed to the next available PSAP call taker. Alternatively if the 
originating caller does not respond within a short time period, then the call is also re-routed to the next available PSAP call taker. 
The voice announcement may either be synthesized by a text-to-speech card, or an PSAP operator may store a voice message which 
describes the incident at the above-referenced location. 

20 
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Patent Claims 

We claim: 

1. An apparatus for locating a first mobile station for at least transmitting and receiving radio signals, wherein said radio 

signals are received on a forward radio bandwidth and said radio signals are transmitted on a different reverse radio 
bandwidth, comprising: 

a first wireless network infrastructure for communicating with said first mobile station, said first wireless 
network infrastructure having: 

(Al) a plurality of spaced apart base stations for communicating via said radio signals with said first 
mobile station, and 

(A2) a mobile switching center for communicating with said first mobile station, via said radio signals 
with the base stations, wherein said mobile switching center also communicates with said 
plurality of base stations for receiving measurements of said radio signals, said measurements 
including: (i) first measurements of said radio signals received by said first mobile station in said 
forward radio bandwidth, and (ii) second measurements of said radio signals transmitted by said 
first mobile station in said reverse radio bandwidth; 
a location determining means for locating said first mobile station, wherein said location determining means 
receives said first and second measurements from the mobile switching center for estimating a location of said first 
mobile station, wherein said estimate is a function of both said first measurements and said second measurements. 

2. An apparatus for locating a mobile station as claimed in Claim I, further including an interface means between said, 

location determining means and said mobile switching center, wherein said interface means generates a location 
request for a primary one of said base stations to which said first mobile signaling means is in communication. 

3. An apparatus for locating a mobile station as claimed in Claim I, further including a means for requesting data related 

to additional radio signals between said first mobile station and at least a second wireless network infrastructure 
different from said first wireless network infrastructure. 

4. An apparatus for locating a mobile station as claimed in Claim I, wherein said first wireless network infrastructure is 

capable of communicating at least one of voice and visual information with said first mobile station. 

5. An apparatus for locating a mobile station, comprising: 

a wireless network infrastructure for communicating with a plurality of mobile stations, each said mobile 
station for transmitting and receiving wireless signals, wherein said wireless signals are received in a forward 
bandwidth and said wireless signals are transmitted in a different reverse bandwidth, and, said wireless network 
infrastructure having a plurality of spaced apart base stations for communicating via said wireless signals with said 
plurality of mobile stations; 
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a location determining means for communicating with said plurality of mobile stations, via said radio signals 
with the base stations, wherein said location determining means communicates with said plurality of base stations 
for receiving measurements related to said radio signals for estimating a location of at least a first of said plurality 
of mobile stations, said measurements including: (i) first measurements of said wireless signals received by said first 
mobile station in said forward radio bandwidth, and (ii) second measurements of said wireless signals transmitted 
by said first mobile station in said reverse radio bandwidth; 

wherein said location determining means estimates a location of said first mobile station using both said first 
measurements and said second measurements. 

6. An apparatus for locating a mobile station as claimed in Claim 5, wherein said second measurements are determined 

from said wireless signals being received by said base stations. 

7. An apparatus for locating a mobile station as claimed in Claim S, wherein said measurements include at least one of: a 

delay spread, a signal strength, a ratio of energy per bit versus signal to noise, a word error rate, a frame error rate, 
a mobile signaling means, a power control value, a pilot index, a finger identification, an arrival time, an 
identification of said first mobile station for communicating with the wireless network infrastructure, a make of said 
first mobile station, a revision of said first mobile station, a sector identification of one of the base stations receiving 
said radio signals transmitted from said first mobile station. 

8. An apparatus for locating a mobile station as claimed in Claim S, wherein said radio signals are communicated using 

one of: CDMA, W-CDMA, TDMA and advanced mobile phone service. 

9. An apparatus for locating a mobile station as claimed in Claim 5, wherein said location determining means includes a 

location estimator using time difference of arrival data from said measurements. 

10. An apparatus for locating a mobile station as claimed in Claim 9, wherein said location estimator receives said 
measurements from a distributed antenna system. 

1 1. An apparatus for locating a mobile station as claimed in Claim 9, wherein said location estimator receives active, 

candidate and remaining set information from said first mobile signaling means. 

12. An apparatus for locating a mobile station as claimed in Claim I , wherein said location determining means includes: 

a receiving means for receiving first data related to at least one of said first measurements and said second 
measurements between said first mobile station and said wireless network infrastructure; 
activating a first location estimator for outputting a first estimate of a location of said first mobile station when 
supplied with location information from said receiving means, said location information related to the first data; 
outputting said first estimate of the location of said first mobile station when said first estimate has an extent less 
than or equal to a predetermined size; 

activating a second location estimator for outputting a second estimate of a location of said first mobile station 
when said first location estimator does not provide said first estimate having an extent less than or equal to a 
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predetermined size; 

outputting an estimate of the location of said first mobile station when said second location estimator provides said 
second estimate. 

13. A method for locating a wireless mobile station, comprising: transmitting, by a first short range transceiver station, a 
5 status change related to whether the mobile station and said first short range transceiver station are able to 

wirelessly communicate through a telephony network to a predetermined storage; storing, in said predetermined 
storage, said status of a mobile station, wherein said status has a first value when the mobile station communicates 
with said short range transceiver station as a cordless telephone, and said status has a second value when the mobile 
station communicates with a network of base stations, wherein said base stations are cooperatively linked for 
10 providing wireless communication; detecting, by said first short range transceiver station, a change accessing said 

predetermined storage for determining a location of the mobile station. 

14. A method for locating a wireless mobile station, as claimed in Claim 13, wherein said short range transceiver is a home 

base station. 

15. A method for locating a wireless mobile station, as claimed in Claim 13, wherein said predetermined storage is 
15 accessible via one of: an autonomous notification message and a request-response message. 

16. A method for locating a wireless mobile station, as claimed in Claim 13, wherein said predetermined storage is a home 

location register. 

17. A method for locating a wireless mobile station, as claimed in Claim 13, wherein said predetermined storage includes 
one or more of the following data hems related to said mobile station: mobile station identification number, short 

20 range transceiver identification and mobile switch center identification. 

1 8. A method for locating a wireless mobile station, as claimed in Claim 13, wherein said step of accessing includes 
responding to a query of said predetermined storage location using an identification of the mobile station. 

19. A method for locating a wireless mobile station, as claimed in Claim 13, further including providing said status from 
said predetermined storage together with an identification of the mobile station to a mobile station location 

25 estimator for estimating a location of the mobile station. 

20. A method for location a wireless mobile station, as claimed in claim 17, wherein said step of transmitting further 
includes associating said change with a predetermined fixed location and said short range transceiver identification. 

21. A method for location a wireless mobile station, as claimed in claim 13, wherein said step of accessing includes 

translating the mobile identification number and said short range transceiver identification into a predetermined 
30 location when the status has said first predetermined value. 

22. A method for location a wireless mobile station, as claimed in claim 13, further including a prior step of provisioning a 
translating database from a customer care system containing the location of the short range transceiver. 

23. A method for locating a wireless mobile station, comprising: receiving data of wireless signals communicated between 
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a mobile station and a wireless network; detecting, using said first data, that the mobile station is in wireless 
communication with a distributed antenna system having a plurality of antennas connected in series and distributed 
along a signal conducting line so that there is a predetermined signal time delay between said antennas and at 
predetermined locations; determining a plurality of signal time delay measurements for signals transmitted between 
the mobile station and a collection of some of said antennas, wherein said signals are also communicated through 
said line; estimating a location of the mobile station using said plurality of signal time delay measurements. 

24. A method for locating a wireless mobile station as claimed in Claim 23, wherein said step of estimating includes 
correlating each measurement of said plurality of signal time delay measurements with a unique corresponding one 
of said antennas. 

25. A method for locating a wireless mobile station as claimed in Claim 24, wherein said step of estimating includes: 
identifying a plurality of antennas in said collection using correlation obtained in said step of correlating; 
determining a corresponding signal time delay between the mobile station and each antenna in said collection; 
determining a location of each antenna in said collection; estimating a location of the mobile station using said 
corresponding signal time delays and said locations of each antenna in said collection. 

26. A method for locating a wireless mobile station as claimed in Claim 23, wherein said step of estimating includes 
determining, for said signal time delay measurements, a common signal time delay corresponding to transmitting 
signals from said distributed antenna system to a receiver of the first wireless network. 

27. A method for locating a wireless mobile station as claimed in Claim 23, wherein said step of estimating includes using 
an absolute delay time with respect to a pilot channel for a base station on the wireless network. 

28. A method for locating a wireless mobile station as claimed in Claim 23, wherein said step of estimating includes 
performing a triangulation using values related to one of: a signal time of arrival, and a signal time difference of 
arrival for time difference of arrival corresponding to each antenna in said collection. 

29. A method for locating a wireless mobile station, as claimed in Claim 23 wherein said step of estimating includes a step 
of computing a most likely location of said mobile station using a fuzzy logic computation. 

30. A method for locating a wireless mobile station as claimed in Claim 23, wherein said step of activating includes 
activating one of: 

(a) a location estimator for determining whether the mobile station is detected by a base station of the 

network, wherein said base station communicates with the mobile station as a cordless telephone; 

(b) a location estimator for estimating a location of the mobile station using location information obtained 

from said distributed antenna system; 

(c) a location estimator for estimating a location of the mobile station by one of: triangulation and 

trilateration. 

31. A method for locating a wireless mobile station, comprising: first receiving first signal characteristic measurements of 
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wireless signals communicated between a mobile station and a first network of base stations, wherein said base 
stations in the first network are cooperatively linked by a first wireless service provider for providing wireless 
communication; instructing the mobile station to search for a wireless signal from a second network of base stations 
that are cooperatively linked by a second wireless service provider for providing wireless communication, wherein 
said first and second wireless service providers are different; second receiving second signal characteristic 
measurements of wireless signals communicated between the mobile station and said second network of base 
stations; estimating a location of the mobile station using said first and second signal characteristic measurements. 

32. A method for locating a wireless mobile station as claimed in Claim 31 , wherein the mobile station is registered for a 
wireless communication service with the first wireless service provider, and the mobile station is not registered for 
the wireless communication service with the second wireless service provider. 

33. A method for locating a wireless mobile station as claimed in Claim 3 1 , wherein said step of instructing includes 
transmitting a command to the mobile station for instructing the mobile station to search for a signal from a base 
station of said second wireless service provider in a frequency bandwidth different from a frequency bandwidth for 
communicating with the base stations of said first wireless service provider. 

34. A method for locating a wireless mobile station as claimed in Claim 3 1 , wherein said step of instructing includes 
transmitting a command to the mobile station for instructing the mobile station to hand-off from said first service 
provider to a base station associated with said second service provider, for purposes of performing additional signal 
measurements. 

35. A method for locating a wireless mobile station as claimed in Claim 3 1 , wherein said first signal characteristic 
measurements include measurements for time delay, signal strength pairs of signal communicated from at least one 
of: 

(a) the base stations of said first network to the mobile station, and 

(b) the mobile station to the base stations of said first network, and 

wherein said second signal characteristic measurements include measurements for time delay, signal strength pairs 
of signals communicated from the base stations of said second network to the mobile station. 

36. A method for locating a wireless mobile station, comprising: receiving first data related to wireless signals 
communicated between a mobile station and at least a first network of a plurality of commercial mobile service 
provider networks of base stations, wherein for each said network, there is a plurality of base stations for at least 
one of transmitting and receiving wireless signals with a plurality of mobile stations; instructing the mobile station 
to communicate with a second network of the plurality of networks for supplying second data; activating a mobile 
station location estimator, when said first and second data are obtained for providing an estimate of a location of 
the mobile station. 

37. A method for locating a wireless mobile station, as claimed in Claim 36, wherein said second network includes a 
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second plurality of base stations, wherein a majority of base stations in said second plurality of base stations has a 
location different from the locations of base stations in said first network. 

38. A method for locating a wireless mobile station, as claimed in Claim 36, wherein at least one of said first and second 
data includes signal characteristic measurements of communication with the mobile station for a time interval of less 
than 10 seconds. 

39. A method for locating a wireless mobile station, comprising: first receiving first signal characteristic measurements of 
wireless signals communicated between a mobile station and a first network of base stations, wherein said base 
stations in the first network are cooperatively linked by a first wireless service provider for providing wireless 
communication; instructing a second network of base stations that are cooperatively linked by a second wireless 
service provider for providing wireless communication so that the second network searches for wireless signals from 
the mobile station, wherein said first and second wireless service providers are different; second receiving second 
signal characteristic measurements of wireless signals communicated between the mobile station and said second 
network of base stations; estimating a location of the mobile station using said first and second signal characteristic 
measurements. 

40. A method for locating a wireless mobile station, as claimed in Claim 39, further including a step of requesting the 
mobile station to raise it's transmitter power level to a predetermined level, prior to said step of instructing. 

41. A method for locating a wireless mobile station, comprising: receiving, by a receiving means, first data related to 
wireless signals communicated between a mobile station and at least a first network of a plurality of commercial 
mobile service provider networks, wherein for each said network, there are a plurality of communication stations for 
at least one of transmitting and receiving wireless signals with a plurality of mobile stations; first activating a 
location estimator for providing a first estimate of a location of the mobile station when supplied with first location 
information from said receiving means, said first location information related to the first data; 

when one of: (a) said first estimate does not exist, and (b) said first estimate has an extent greater than or equal to 
a predetermined size, the steps (Al) and (A2) are performed: 

(Al) instructing the mobile station to communicate with a second network of the plurality of networks for supplying 

second data to said receiving means, wherein said second data is related to wireless signals communicated 

between the mobile station and the second network; 
(A2) second activating said location estimator a second time for providing a second estimate of a location of the 

mobile station when supplied with additional location information from said receiving means, said additional 

location information related to the second data; 
outputting at least one of the estimates of the location of the mobile station provided by said location estimator 
when said location estimator provides at least one estimate of the location of the mobile station. 

42. A method for locating a wireless mobile station as claimed in Claim 41, wherein said additional location information 
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and said first location information are utilized together by said location estimator. 

43. A method of locating a wireless mobile station as claimed in Claim 41, wherein said communication stations include 
wireless base stations for one of CDMA, TDMA, and GSM. 

44. A method of locating a wireless mobile station as claimed in Claim 43, wherein said communication stations include 

home base stations. 

45. A method of locating a wireless mobile station as claimed in Claim4l, wherein the mobile station includes one of: a 

CDMA transmitter, a TDMA transmitter, and a GSM transmitter, and a AMPS transmitter. 

46. A method for locating a wireless mobile station as claimed in Claim 41, wherein one or more of said activating steps 
includes : 

(a) said location estimator for determining whether the mobile station is detected by a communication station 

which communicates with the mobile station as a cordless telephone; 

(b) said location estimator for estimating a location of the mobile station using location information related 

to data from a distributed antenna system; 

(c) said location estimator for estimating a location of the mobile station by one of: triangulation and 

trilateration. 

47. A method for locating a wireless mobile station as claimed in Claim 41, wherein said predetermined extent is less than 
one thousand feet. 

48. A method for locating a wireless mobile station, comprising: receiving, by a receiving means, first data related to 
wireless signals communicated between a mobile station and at least a first network of one or more commercial 
mobile service provider networks, wherein for each said network, there is a different plurality of base stations for at 
least one of transmitting and receiving wireless signals with a plurality of mobile stations; activating a first location 
estimator for outputting a first estimate of a location of the mobile station when supplied with location information 
from said receiving means, said location information related to the first data; outputting said first estimate of the 
location of the mobile station when said first estimate has an extent less than or equal to a predetermined size; 
activating a second location estimator for outputting a second estimate of a location of the mobile station when said 
first location estimator does not provide said first estimate having an extent less than or equal to a predetermined 
size; outputting an estimate of the location of the mobile station when said second location estimator provides said 
second estimate. 

49. A method for locating a wireless mobile station as claimed in Claim 48 further including a step of instructing the 
mobile station to communicate with a second network of the plurality of networks for supplying second data to said 
receiving means, wherein said second data is related to wireless signals communicated between the mobile station 
and the second network. 

50. A method for locating a wireless mobile station as claimed in Claim 49, wherein said step of instructing includes a 
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step of instructing the mobile station to hand-off to said second network for synchronizing timing signals and 
performing measurements between the mobile station an said second network. 

51. A method for locating a wireless mobile station as claimed in Claim 48, wherein one or more of said activating steps 
includes activating one of: 

5 (a) a location estimator for determining whether the mobile station is detected by one of the base stations 

which communicates with the mobile station as a cordless telephone; 

(b) a location estimator for estimating a location of the mobile station using location information related to 

data from a distributed antenna system; 

(c) a location estimator for estimating a location of the mobile station by one of: triangulation and 
10 trilateration. 

52. A method for locating a mobile station, comprising: receiving, by said mobile station, a request control message from 
one of a plurality of base stations, wherein said message is received by a receiving antenna of said mobile station; 
the control message providing information related to said message to at least one of a control processor and a 
searcher receiver in said mobile station; determining, using at least one of said control processor and said searcher 

15 receiver, a plurality of pairs of radio signal strength related values and corresponding signal time delays for a 

wireless communication between said mobile station and at least a first of the base stations, wherein for at least 
some of said pairs, said signal time delays are different, and for each pair, said signal strength related value for said 
pair is obtained using a signal strength of said communication at said corresponding signal time delay of said pair; 
transmitting signals for said pairs to one or more of the base stations via a transmitting antenna of said mobile 

20 station; routing data for at least one of said pairs from said one or more base stations to a mobile station location 

estimator for estimating a location of said mobile station. 

53. A method for locating a mobile station, as claimed in Claim 52, wherein said step of receiving uses one of a CDMA, an 
AMPS, a NAHPS and a TDMA wireless standard. 

54. A method for locating a mobile station, as claimed in Claim 52, wherein said step of determining is performed for a 
25 wireless communication between said mobile station and each of a plurality of the base stations. 

55. A method for locating a mobile station, as claimed in Claim 52, wherein each of said signal time delays is included 
within a predetermined corresponding time delay spread. 

56. A method for locating a mobile station, as claimed in Claim 52, wherein said step of determining includes a step of 
instructing, by said control processor, said searcher receiver to output a plurality of said radio signal strength 

30 related values for a plurality of fingers resulting from said communication from said first base station to said mobile 

station. 

57. A method for locating a mobile station, as claimed in Claim 52, wherein said step of determining includes inputting 
data for said pairs to a modulator for modulating said data prior to said step of transmitting. 
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58. A method for locating a mobile station, as claimed in Claim 57, further including a step of establishing a software 
controllable data connection between said control processor and a mobile station component including at least one 
of: a user digital baseband component and said modulator, wherein said connection inputs said data to said 
component 

59. A method for locating a mobile station, as claimed in Claim 52 further including a step of providing said data for said 
pairs to a mobile station location estimating system having a first mobile station location estimating component 
using time difference of arrival measurements for locating said mobile station via one of trilateration and 
triangulation. 

60. A method for locating a mobile station, as claimed in Claim 59, wherein said step of providing includes selecting one 
of: said first mobile station estimating component, a second mobile station estimating component using data 
obtained from a distributed antenna system, and a third mobile station estimating component for using data 
obtained from activation of a home base station. 

61. A method for locating a mobile station, as claimed in Claim 60, further including a step of computing a most likely 

location of said mobile station using a fuzzy logic computation. 

62. A method for locating a mobile station, as claimed in Claim 61, wherein said step of computing is performed by said 
second mobile station estimating component for determining a most likely floor that said mobile station resides in a 
multi-story building having a distributed antenna system. 

63. A method for locating a mobile station, as claimed in Claim 59, further including a step of requesting data for 
additional pairs of radio signal strength related values and corresponding signal time delays for a wireless 
communication between said mobile station and at least a second base station of a commercial mobile radio service 
provider different from a commercial mobile service provider for said first base station. 

64. A method for obtaining data related to wireless signal characteristics, comprising: providing a user with a mobile 
station for use when the user traverses a route having one or more predetermined route locations, wherein one or 
more of the route locations have a corresponding telephone number and a corresponding description stored in the 
mobile station; performing the following substeps when the user visits each of the route locations: activating a call to 
said corresponding telephone number; transmitting a code identifying the route location when the user is 
substantially at the route location; storing an association of: 

(a) signal characteristic measurements for wireless communication between the mobile station 

and one or more base stations, and 

(b) a unique identifier for the route location obtained using said code transmitted by said call; 
Wherein said stored signal characteristic measurements are accessible using said unique 

identifier. 

65. A method as claimed in Claim 64, wherein said unique identifier corresponds to one of: (a) an address for the route 
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location, and (b) a latitude and longitude of the route location. 

66. A method as claimed in Claim 64, wherein said route is periodically traversed by a user having a mobile station for 
accomplishing said step of performing. 

67. A method as claimed in Claim 64, wherein said step of storing includes retaining said signal characteristic 

5 measurements in a data storage for analyzing signal characteristic measurements of wireless communications 

between mobile stations and a wireless infrastructure of base stations. 

68. A method as claimed in Claim 64, further including, prior to said step of activating, a step of determining, by the 
user, that a display on the mobile station uniquely identifies that said corresponding description of the route 
location is available for calling said corresponding telephone number and transmitting said identifying code. 

10 69. A method as claimed in Claim 64, wherein said step of storing includes: obtaining a phone number identifying the 

mobile station; providing said phone number identifying the mobile station to a commercial mobile radio service 

provider in a request for said signal characteristic measurements. 
70. A method as claimed in Claim 64, wherein said step of storing includes using a phone number identifying the mobile 

station in combination with said transmitted identifying code for determining said unique identifier. 
15 71. A method as claimed in Claim 64, wherein said corresponding description includes at least one of: a textual 

description of its corresponding route location, and an address of its corresponding route location. 
72. A method as claimed in Claim 64, further including steps of: associating said identifying code for the route location 

and said unique identifier in a data storage prior to performing said step of performing; accessing said data storage 

using said identifying code for obtaining said unique identifier in said step of storing. 
20 73. A method as claimed in Claim 64, further including a step of accessing said stored signal characteristic measurements 

for enhancing a performance of a process for locating mobile stations. 

74. A method as claimed in Claim 64, wherein at least two of said one or more base stations are in networks of different 
commercial mobile radio service providers. 

75. A method as claimed in Claim 64, further including a step of filtering said signal characteristic measurements so that 
25 when said signal characteristic measurements are suspected of being transmitted from a location substantially 

different from the route location, said step of storing is one of: (a) not performed, and (b) performed so as to 
indicate that said signal characteristic measurements are suspect. 

76. A method as claimed in Claim 75, wherein said step of filtering includes at least one of: (a) determining an amount by 
which an estimated location of the mobile station using said signal characteristic measurements differs from a 

30 location of the mobile station obtained from said unique identifier; (b) determining whether a predetermined 

amount of time has elapsed between successive performances of said step of activating. 

77. A method for locating a wireless mobile station, comprising: 

first receiving first signal characteristic measurements of wireless signals communicated between a mobile station 
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and a first network of base stations, wherein said first signal characteristic measurements includes: 

(a) one or more pairs of wireless signal strength related values and corresponding signal time delays for a 

wireless communication between the mobile station and at least a first of the base stations; 

(b) data identifying operational characteristics of the mobile station including information related to a signal 

transmission power for the mobile station and information for determining a maximum transmission 

power level of the mobile station; 
adjusting, for at least one of said pairs, its corresponding wireless signal strength, using said data, thereby obtaining 
corresponding adjusted pairs, wherein each adjusted pair has the corresponding adjusted signal strength, and 
wherein said adjusted signal strength is an expected signal strength of a predetermined standardized mobile station 
transmitter power level having a predetermined maximum transmission power and operating at a predetermined 
transmission power level; 

outputting second signal characteristic information, obtained using said adjusted signal strength, to a mobile station 
location estimator for determining a location estimate of said first mobile station. 

78. A method for locating a mobile station as claimed in Claim 77, further including applying sequence of one or more 
signal processing filters to one of: said pairs and said adjusted pairs. 

79. A method for locating a mobile station as claimed in Claim 78, wherein said sequence of filters is dependent upon a 
corresponding mobile station location estimator. 

80. A method for locating a mobile station as claimed in Claim 79, wherein said sequence of filters is pipelined so that for 
first and second filters of said sequence, an output of said first filter is an input to said second filter. 

81. A method for locating a mobile station as claimed in Claim 79, wherein said filters include Sobel, Werner, median and 
neighbor. 

82. A method for locating a wireless mobile station, comprising: 

first receiving first signal characteristic measurements of wireless signals communicated between a mobile station 
and a first network of base stations, wherein said first signal characteristic measurements includes one or more pairs 
of wireless signal strength related values and corresponding signal time delays for a wireless communication between 
the mobile station and at least a first of the base stations; 

categorizing said pairs into categories according to ranges of signal strength related values and ranges of 
corresponding signal time delays for obtaining a representation of a frequency of occurrence of said one or more 
pairs in said categories; 

applying one or more filters to said representation for one of: (a) reducing characteristics of said representation that 
are expected to be insufficiently repeatable for use in identifying a location of the mobile station, and (b) enhancing 
a signal to noise ratio; 

supplying an output obtained from said step of applying to a mobile station location estimator; 
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estimating a location of the mobile station using said mobile station location estimator. 

83. A method for locating a wireless mobile station as claimed in Claim 82, further including a step of requesting data for 

additional pain of wireless signal strength related values and corresponding signal time delays for a wireless 
transmission between the mobile station and at least a second base station of a second network of base stations 
5 different from the base stations of the first network, wherein said first and second networks communicate with the 

mobile station in different signal bandwidths. 

84. A method for locating a wireless mobile station as claimed in Claim 83, wherein the first network is operated by a first 
commercial mobile radio service provider and the second network is operated by a second commercial mobile radio 
service provider. 

10 85. A method for locating a wireless mobile station as claimed in Claim 82, wherein said representation corresponds to a 

histogram. 

86. A method for locating a wireless mobile station as claimed in Claim 82, further including a step of normalizing one of: 

(a) said pairs, and (b) values corresponding to said output. 

87. A method for locating a wireless mobile station as claimed in Claim 23, wherein said step of activating further includes 
IS the step of applying a fuzzy logic module which further discretizes the location estimate provided from one of: 

(a) a location estimator for estimating a location of the mobile station using location information obtained 

from said distributed antenna system; 

(b) a location estimator for estimating a location of the mobile station by one of: triangulation and 

trilateration. 

20 88. A method for contacting a telephony station, comprising: associating, by a user, a particular telephony number with a 

collection of one or more telephony station numbers of telephony stations with which the user desires to 
communicate when said particular telephony number is ailed from a predetermined telephony station; receiving 
said particular telephony number from the predetermined telephony station; determining a location of said 
predetermined telephony station and at least some of said telephony stations having telephony station numbers in 

25 said collection; selecting a first of said telephony stations having telephony station numbers in said collection, 

wherein said first telephony station is selected according to a location of said predetermined telephony station and a 
location of first telephony station; transmiting a user desired message to said first telephony station. 
89. A method for locatin a mobile station, comprising: establishing, by a user of a particular mobile station, a collection of 
identities of one or more persons having permission to receive a location of said particular mobile station; receiving 

30 a request by a first of said persons for locating said particular mobile station; determining a location of said 

particular mobile station in response to said request, said location determined using measurements of wireless 
transmissions between said particular mobile station and a first wireless network of base stations, wherein said base 
stations are cooperatively linked for wireless communication; outputting said location to the first person. 
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90. A method as claimed in Claim89 t wherein said step of determining includes using measurements of wireless 

transmissions between said particular mobile station and a second wireless network of base stations provided by a 
different commercial wireless service provider from a commercial wireless service provider for the first wireless 
network. 

91. An apparatus for locating a mobile station as claimed in Claim 3, further including a means for providing a location 

estimate using the Internet 

92. An apparatus for locating a mobile station as claimed in Claim 3, further including a means for providing a location 
estimate using the Internet 

93. An apparatus for locating a mobile station as claimed in Claim 3, further including a means for providing a location 
estimate using digital certificate keys and the Internet. 

94. An apparatus for locating a mobile station as claimed in Claim 91, further including a means for providing a location 
estimate using push technology on the Internet. 
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FIG. 15: CDMA Mobile Station Prior Art 
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FIG. 16: MS Modification for RF Signal Telemetry 
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Figure 17: Location and a Home Base Station 
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Fig. 19: WIS at location A, detects BSs 1b, 5c, 2c and 4a 
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